Suppose one wishes to implement an account system for their service/website. There have been cases with Instagram for example where passwords were accidentally stored in plain text due to accidentally logging them. While I hope never to make the mistake, is it viable to do an unsalted hash on the front end and send that to the back end instead? Should the same or similar mistake ever be made, at the very least it's not a plain-text password as the real password was never even sent in the first place, but the back end will still use bcrypt to salt, hash, and store the password securely? While I understand an unsalted hash isn't particular strong, if in the scenario of a mis-configuration which does somehow log or by any other means store the unhashed password, at least a SHA512 hashed password is stored rather than a plain-text password? For example: 1. User inputs password on front end. 2. SHA512 3. Send to Server-Side 4. bcrypt 5. Store result in database (Assume HTTPS is configured for web server, and SSL is configured on MySQL.) Is this a viable setup, or done by anyone? Is there anything wrong with the justification?