BeCuriouzLearn something new every day
Good websites don't actually know your password
💡 Well-built sites store a salted, slow hash of your password — not the password itself — so a database breach yields scrambles, not logins.
When you sign up somewhere trustworthy, the site does not save your password in a column it can read back. Instead it runs your password through a hash function — a one-way math process that turns any input into a fixed-length scramble. Hashing is easy to do forwards but practically impossible to reverse, so even if attackers steal the database, they get gibberish like a3f9c2… instead of your actual password. When you log in, the site hashes what you typed and checks that the two scrambles match.
There's a catch: if two people both pick sunshine, naive hashing produces the same scramble for both. Attackers exploit this with rainbow tables — giant precomputed lists of common passwords and their hashes. The defense is a salt: a unique random string mixed into each password before hashing, so identical passwords end up with totally different stored hashes and precomputed tables become useless.
Modern systems go further and use deliberately slow hashing algorithms like bcrypt, scrypt, or Argon2. A fast hash lets an attacker try billions of guesses per second against a stolen database; a slow one might allow only thousands, turning a quick crack into an infeasible one. This is also why a site that can email you your original password is a serious red flag — it means they never hashed it at all.