Is there any way to not show the password in the payload of the request?

I'm trying to ensure that when a user enters their password to log in, it doesn't appear in the payload of the request. In the backend, I'm using express.js and encrypting passwords with bcrypt. In the frontend I'm using solid.js How can I make sure the password doesn't appear if I look in the devtools?

What I can see in devtools right now

I've tried hashing them on the frontend and sending them to the backend, but what it receives is not the same. I've also looked into JWT, but I'm not sure if it's closely related to this... I just want it to logically validate if the user is correct and their password is correct to access the application, but without the password being discoverable if someone accesses the devtools.

Solution

As commenters have said, the fact that a password appears in plaintext in the payload is not a security issue - as long as you're using https.

But if you are concerned about the password:

ending up in plaintext in web-servers logs (like the thing Facebook was fined for)
ending up in memory, and being disclosed due to bugs in OpenSSL (e.g. Heartbleed)

then there is a way to prevent the transmission of the user's plaintext password to the server.

Secure Remote Password protocol

Unfortunatley it means you'll have to abandon bcrypt entirely; since under SRP a hash of the password is useless.

The usual way around that is to:

keep the bcrypt hashed password until the next time the user shows up
then force them to login
then you can apply the SRP algorithm client-side
and purge the bcrypt password

But a better version is to just use https, and tell regulators, auditors, managers, and governments it is not a problem.