You are right, instead of sending the password in cleartext across the network one should use a javascript function to encrypt it. There are javascript functions available (in public domain too) to encrypt a string. One such very good funtion is used by Yahoo Mail on their login page. They use a challenge response mechanism to authenticate the user. You could do a View Source and see the function (or contact the author and get it). In case the javascript is disabled you will need to ask the user to enable it, because since you are calling the submit of the form only after you encrypt the password so if it is disabled you wont be able to submit the form. Anyways, I guess that should not be a big issue as most sites today make ample use of javascript and hence users are expected to have javascript enabled on their browsers.