What Is a Password Hash? (And Why It Matters When Sites Get Breached)

When you create an account, a well-built website does not save your password. It saves a hash of it. Understanding what that means explains a lot about why some breaches are catastrophic and others are barely a problem.

Hashing in one sentence

A hash function takes any input, your password, and turns it into a fixed-length string of characters that looks like gibberish. The same input always produces the same output, but you cannot reverse the output back into the input. So "sunflower" might become something like a1b2c3... every time, and there is no formula to turn that back into "sunflower."

Why sites hash instead of storing the real thing

When you log in, the site hashes whatever you typed and compares it to the stored hash. If they match, you are in. The crucial benefit: the site never needs to keep your actual password. So when a database leaks, attackers get a pile of hashes, not a pile of passwords.

That is also why a legitimate service can never email you your existing password. It genuinely does not have it. If a site can send you your old password, it is storing passwords in plain text, which is a serious red flag.

So why do breached passwords still get cracked?

Because attackers do not reverse hashes, they guess. They take huge lists of common passwords, hash each one, and look for matches in the leaked database. If your password was "password123," its hash is already in every cracking dictionary, so it falls in milliseconds. This is exactly how hackers crack passwords.

Two defenses make this much harder, and they are on the website's side, not yours:

• Salting. The site adds a unique random value to each password before hashing it. This means identical passwords produce different hashes, so attackers cannot crack them all at once with a precomputed table.
• Slow hashing. Algorithms like bcrypt, scrypt, and Argon2 are deliberately slow. That is invisible when you log in once, but it cripples an attacker trying billions of guesses.

What this means for you

You cannot control how a website hashes your password. You can control the thing that decides whether your hash survives a cracking run: how unpredictable your password is.

• A long, random, unique password is computationally infeasible to crack even if its salted hash leaks.
• A short or common password falls regardless of how well the site hashed it.

This is the practical takeaway: hashing buys you time, but only a strong password turns that time into real protection. Generate long random passwords, keep them unique, and a database leak becomes a non-event for you while it is a crisis for people who reused "qwerty."

If a service you use does get breached, the right moves are the same regardless of how they hashed things: change that password, change it anywhere you reused it, and watch for credential stuffing. See what to do after a data breach for the full checklist. A password manager like Passlock makes the "unique everywhere" part automatic, which is the only part of hashing security that is actually in your hands.