How Websites Store Your Password (and How Hackers Crack It)

If a company can email you your old password, run. A well-built website doesn't know your password — it only knows a fingerprint of it. Here's how that works, and how attackers still try to break it.

Your password is never stored

When you sign up, the site runs your password through a hash function: a one-way mathematical blender. The output (a hash) is stored. When you log in, it hashes what you type and checks if the two hashes match.

The hash lab

Type anything. Change one letter and watch almost every character of the hash change. Then try password with and without salt.

How hackers attack hashes

When a database leaks, attackers get hashes, not passwords. So they guess:

• Lookup / rainbow tables: precomputed hashes of billions of common passwords. Instant match.
• Dictionary attacks: word lists plus tweaks (P@ssw0rd2024! is in them).
• Brute force: every combination. Graphics cards try billions of fast hashes per second.

“Hackers don't reverse hashes. They guess — very, very fast.

Defence: salt + slow hashing

A salt is random data added per user, so two people with the same password get different hashes and precomputed tables become useless. A slow hash like bcrypt or Argon2 is deliberately expensive: what takes a nanosecond with SHA-256 takes ~100 ms — fine for one login, crushing for billions of guesses.

import bcrypt from "bcrypt";

// cost factor 12 → ~4,000 rounds of work per hash
const hash = await bcrypt.hash(password, 12); // salt is generated & stored inside the hash
await db.user.create({ email, passwordHash: hash });

// login
const ok = await bcrypt.compare(attempt, user.passwordHash);

What this means for you

• Length beats complexity: “correct horse battery staple” style passphrases are strong and memorable.
• Never reuse: one leak exposes every site using the same password. Use a password manager.
• Turn on 2FA (an authenticator app or passkey) — a stolen password alone is then useless.