Just use HTTPS then you do not need to encrypt the password since all of your traffic is encrypted anyways. See this post