Is the login encrypted before it is sent? If so how to do I encrypt it the same way?

Question

I've moved my WordPress site onto a https server, but now I'm wondering if I still need to manually encrypt the login credentials for my remote login.

Is the default login encrypted before it is sent? Everything I've read, code included, is all plain text which is really bad for http sites.

In my other projects we used something like an md5 hash to encrypt the password before sending it. But I don't have that project and I don't know if WP is storing plain text passwords or hashed. So I'd rather use existing WP login code if it's available or an example code of how to encrypt it before sending it would help.

PS I'm logging in via a remote application.
PSS I've also seen the other posts and this is not a duplicate.

Answer 1

wordpress do not encrypt anything at client side, but encryption on client side do not help at all with security, it just make password stronger but do not help at all against Main In The Middle, or eaves dropping attacks. No matter how strong is your password encryption, if you send it over HTTP, once I know it, lets say by monitoring wifi traffic, I can use it myself.

Using HTTPS is the only real solution as the protocol layer ensures that everything is encrypted in a unique way per each connection therefor no one can repeat the same packets and gain access as it will fail in the protocol level.

short answer: with HTTPS you don't need to "encrypt" the passwords you send on the wire.