Do not show password, during login, on an insecure channel (without SSL). Use a SHA-256 hash algorithm....