#1 - Most likely in the onClick handler of the login button, assuming that such a button exists. Frankly, if you think that either onCreate or onPause might be suitable then I think you have not grasped how the Activity lifecycle works.
#2 - Before making the WS call. Which other place did you consider?
Then i send the username to web service and get his password from database.them i match the password.
This is not good practice.
You should design the WS call as the logical equivalent of method call "boolean checkLogin (
String username, String hashedPassword)". There is no need to send any password -even hashed- from the backend to the app.
Also make sure that the WS is accessible via HTTPS only, and has the usual web app security measures in place.