If you insist to pass your password in the url you can do the following: create a session at server side. request a cryptographic random token from the server. concatenate the token to the password hash and hash the result again using a proper algo like sha-3/Keccak (or use HMAC instead) More items... Mar 30, 2022