> You're still passing the output to the server, which can be repeated.
Not if the server generates a unique ID for each attempt, and that ID must be used in hashing. It can be as simple as a timestamp.
Not if the server generates a unique ID for each attempt, and that ID must be used in hashing. It can be as simple as a timestamp.