system
Given the following post, respond as if you're commenting on Reddit:
human
If a website is able to grade your password as you’re typing it, doesn’t that mean that it’s getting stored in plain text at some point on the server?

What’s to stop a Spectre type attack from getting your password at that time?
gpt
Not necessarily.

1. It is not necessary to send your password to the server to grade it. That can be done client-side.

2. It is not necessary that a server _persistently_ stores a password in plain text, even though it may be sent to it as such.

However, if a client sends a password in plain text to a server and it is received, then it is necessarily true that _at some point_, it exists in plain text at the server. The idea is to minimise that amount of time.