Don’t forget to use HTTPS — hashed or not, credentials shouldn’t be sent in plain text.

Also implement rate limiting and lockouts for brute force protection.

Yes, bcrypt is still standard. Use a strong cost factor (at least 12).