@falling Spring Security is backend only so in that sense no it doesn't provide you anything for the frontend. However, what that article is suggesting is that you hash before sending it to the backend, so the backend would never even see the plain text password, and instead would have a hash that it would rehash and save in the db, and look up and compare when someone logs in. It's an interesting idea, but if you implemented it on an existing system you would have to force everyone to change their existing passwords to use the new system. I'm not sure this is strictly necessary as you send the password over SSL encrypted and on the other end you should never log a password field. Also, you could use this: https://docs.grails.org/latest/guide/conf.html#maskingRequestParametersFromStacktraceLogs