When a well-run website stores your password, it does not actually keep your password. It keeps a scrambled fingerprint of it called a hash. This single idea is why a data breach does not always hand attackers your login on a plate. Our GetMyPassword team explains what password hashing is and why it matters to you.
What password hashing is
Hashing turns your password into a fixed-length scrambled string using a one-way function. The same password always produces the same hash, but the process cannot be run backwards to recover the original. A secure site stores only this hash. When you log in, it hashes what you typed and compares the two — if they match, you are in, and your real password was never kept anywhere.
Why it protects you in a breach
If attackers steal a database of hashes, they do not get usable passwords directly. To find your password they must guess: hash millions of candidates and look for a match. A strong, unrandom-looking password can take an impractically long time to crack this way — while a weak or common one falls almost instantly, because it is near the top of every guessing list.
Salt and slow hashes
- A salt is random data added to each password before hashing, so identical passwords get different hashes.
- Salting defeats pre-computed lists (rainbow tables), forcing attackers to crack each hash separately.
- Slow, modern algorithms like bcrypt or Argon2 are used on purpose, to make mass guessing expensive.
- Plain or fast hashes (like raw MD5) are a red flag a site is doing it badly.
Hashing means a breached site leaks scrambled fingerprints, not passwords. But a weak password is cracked from its hash in seconds, so the strength of yours is what decides whether that protection holds.
Your part of the equation
You cannot control how a website hashes your password, but you control the password itself — and that is what decides whether a stolen hash ever becomes a stolen account. Use a long, random password from our password generator for every site and turn on two-factor authentication, so even a cracked hash on one breached site cannot open anything else.
Frequently asked questions
What is password hashing in simple terms?
It is turning your password into a fixed-length scrambled string with a one-way function. A secure site stores only this hash, not your password, and checks logins by hashing what you type and comparing. The hash cannot be reversed to the original.
If sites hash passwords, why do breaches still matter?
Because attackers can guess: they hash millions of candidate passwords and look for matches. Weak or common passwords are cracked almost instantly, while long, random ones can resist for an impractically long time.
What is a salt in password hashing?
A salt is random data added to each password before hashing, so two identical passwords produce different hashes. It defeats pre-computed lists like rainbow tables and forces attackers to crack each hash on its own.