Why Don’t Websites Store Your Password Directly?
When you create an account, you might think your password is simply stored in the database.
It shouldn’t be.
Imagine a website stores:
password: mypassword123
If the database gets exposed, attackers can immediately see users’ passwords.
Instead, applications usually hash passwords before storing them.
For example:
mypassword123 → a8f91c...
The application stores the hash, not the original password.
When you log in, your password is hashed again and compared with the stored hash.
If they match:
Login successful ✅
If they don’t:
Invalid password ❌
The important part is that good password hashing is designed to be one-way. You don’t simply “decrypt” the hash to get the original password.
This is why backend developers use password-hashing algorithms such as bcrypt or Argon2.
So remember:
Don’t store passwords. Hash them.
One small backend decision can make a huge difference to your application’s security.
View passport