Is sending a password encrypted or as SHA1 any safer than clear text?

I'm assuming that you are talking about additional hashing. So it would look like this:

Client --sha1(password)--> Server --bcrypt(sha1(password)--> Database

I think you are aware of this, but just to make it explicit: the transfer needs to happen via SSL to defend against eavesdroppers, hashing client-side would be no help against them at all.

Hashing or obfuscating a password client-side can be a good mitigation against password reuse:

Even if an attacker accesses the password in plaintext either in transfer or at the server, it would still be hashed, so an attacker cannot try the same credentials at other websites without first cracking the hash.

It seems to me that if an attacker can intercept my login request, then he can replay it later, no matter whether I try obfuscate it or not.

Yes. Hashing client-side doesn't add any security to your application, the only advantage is that it mitigates bad user behavior, which may affect other applications the user is also using.

Note that it doesn't even protect your application from password reuse, as an attacker that gained that users credentials from another application would just hash it and try that.

It also does not add any complexity to the process of cracking your stored hashes. An attacker would not try a list of hashes as input, but a normal wordlist, which they would first pass through sha1.


As tim wrote, it could help mitigating the effects of password reuse for users in a few cases, but if what you're thinking of is hashing it client side instead of on the server side, this would be a major design flaw.

https://en.wikipedia.org/wiki/Pass_the_hash

This problem plagues the NTLM authentication, where it's actually even worse than in the common Web application/service scenario, since hashes are often cached on systems other than the server handling your authentication.