var xhr = new XMLHttpRequest();
xhr.open('GET', '/change_pw', false);
xhr.onload = function () {
hash = document.getElementsByName("hash")[0].value.innerHTML = xhr.responseText;
};
xhr.send();
alert(xhr.hash);
<input type="hidden" name="hash" value="9f396fe44e7c05c16873b05ec425cbad">