How password hashing works: bcrypt, Argon2, and why plain text storage is malpractice

You can't control how websites store your password, which is exactly why you should never reuse them. A strong unique password per site, plus 2FA, means that even if a site stores passwords in plain text (and gets breached), only that one account is affected.

When you create an account on a website, the site should hash your password before storing it. A hash is a one-way mathematical function: the same input always produces the same output, but you can't reverse the output to get the input. When you log in, the site hashes what you typed and compares it to the stored hash. If the database is breached, attackers see hashes, not passwords.

By TechCompare · Updated August 2026

Security domain

Fundamentals

How passwords and hashing work

Topic focus

Password hashing

password-hashing

How this is calculated

Not all hashing is equal. A simple SHA-256 hash of a password is fast to compute, which means it's fast to brute-force. Modern password hashing algorithms (bcrypt, Argon2, PBKDF2) are deliberately slow and memory-intensive. bcrypt has a configurable cost factor that doubles the work with each increment. Argon2 (the winner of the 2015 Password Hashing Competition) adds memory hardness, making it expensive to attack with GPUs and ASICs. If a website emails you your password in plain text after signup, they are storing it without hashing, which is gross negligence. Close your account immediately. You can't fix their security, and if they're doing that wrong, everything else is probably wrong too.

Verdict

Hashing quality varies wildly and that variance is the reason not to trust any one site. SHA-256 is fast, which makes brute force fast, whereas bcrypt doubles work per cost factor and Argon2 adds memory hardness that punishes GPUs and ASICs. A service that emails your plaintext password back to you is storing it unhashed, which signals broader neglect. Unique passwords plus 2FA contain the blast radius when the worst case happens.