Users' passphrases should exist only on the user's end, not at the server end.

For more discussion of security standards for bitcoin check out https://bitcointalk.org/index.php?topic=95745.0

-MarkM-