> Do databases store the hash of the password or not? Yes, they do. > And if they do so, can the thing I wrote above happen? Perhaps it could, but it's unlikely. It is usually easier to find the original password rather than a collision. With a strong hash function, it is difficult to find another string with the same hash as the string 'hello', but easy to quickly verify whether the hash really matches 'hello'. Even strong [key-derivation functions][1] have to use few enough rounds to handle a number of users (on the server), so they would usually allow an attacker to make tens to thousands of guesses per second. When a salt is used, each user's hash has to be attacked individually. Nevertheless, if the password is e.g. on a list of top 1000 passwords (which [can be over 90% of them][2]), like 'hello' is, it will fall in a matter of seconds. [1]: https://crypto.stackexchange.com/questions/tagged/key-derivation [2]: https://xato.net/passwords/more-top-worst-passwords/