What’s the difference between this and CBOR?

But your password should never reach the server. It should be hashed already at the client and then salted at the server with a random hash. Then you store the salted hash

But the thing is that you should never have access to the plaintext password and thus you should never be able to receive it in an email. You should store the salted hash of the password instead of the password itself.

699€ so far… That’s a lot