The most secure way of sending passwords I have found so far 

is to first ask for and receive a one-time code from the server

and mask (hash) the password being sent back to the server with the one-time code.