If Passwords Are Hashed, How Do Hackers Still Crack Them?

Every few months there's a breach announcement. Some company apologizes, tells users to reset their passwords, and adds, almost reassuringly, that passwords were "stored as hashes." The implication is that even though the database was stolen, the passwords themselves are safe. Sometimes that's true. Often it's not. And the reason why gets at something genuinely interesting about how password cracking actually works. What a Hash Actually Is When you create an account and set a password, a well-designed system doesn't store what you typed. It runs your password through a hash function, stores the result, and throws the original away. A hash function takes any input and produces a fixed-length output. Feed it correct-horse-42 and it spits out a string of characters. Feed it correct-horse-43 and it spits out something completely different. The output looks random, and crucially, you can't go backwards. There's no decryption key, no algorithm that takes the output and gives