Out of the box there is no mechanism for a user to login via the REST API to begin a session without pre-configured access. WordPress Core provides 2 authentication methods for the REST API:
- cookies + nonces
- application passwords
Likewise there is no mechanism for registering for an account via the REST API, user creation requires authenticated requests from a user with admin access. Note that making such requests carries risk, you do not want those kinds of credentials being used in your application as it would make your site extremely easy to hack.
You might be able to do this via 3rd party authentication plugins however.
https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/#authentication-plugins
There are also plugins that try to fill this gap, though I cannot recommend them here as recommendations are off topic here, and any recommendation would be quickly out of date.
The problem is that in my JSON API user passwords are stored in hashed form, something like that:
Exposing hashed passwords is dangerous, exposing plaintext passwords is even more dangerous. Both would be considered a data breach. Storing plaintext passwords would be seen as gross negligence and would make your app fail many forms of compliance. It could be illegal to offer your application in some countries if plaintext passwords were used.
The user_pass is of no use to you here, and its presence in your example implies that you’ve given your application an alarming level of access to your site.