first of all, the password is definitely not the encrypted password, but the hash that stores the password. Second, as long as it is https, there is no loophole in sending plaintext username and password to the server. Https is already point-to-point encryption. Finally, a lot of current practices are that the client sends the hash, of the password and then the server hash. For example, the password is "password", the client hash 500times, send hash string to the server, the server hash the string 175times, and then store the database. In this way, no one knows what the password is except the user himself.

must be a plaintext password, because all the encryption at the front end is the emperor's new clothes, and it is taken off by others every minute, so there is no need to encrypt it at the front end, which is time-consuming and laborious. The entire process should be encrypted with https during transmission.