Hopefully the important data is also not stored on the system in clear text and the key to decrypt it is stored on a different server only held in a secure area

Hopefully the important data is also not stored on the system in clear text and the key to decrypt it is stored on a different server only held in a secure area of memory while the process is working. Password have value beyond one system they can be used to impersonate the user and often they are reused on other sites like email accounts (which can be used with reset password almost everywhere to gain access to those sites). "you could sign up for an account on the service using a known password, dump the hash of the known password, and swap out the hash of the privileged user. That way you wouldn't need to know the details of the hashing implementation." The hash should also have a salt included (which hopefully is also not stored on the same server as the database) so hashing is salt + password =hashingfunction> hash. The salt can also be a supplemented by a user specific info (unique account id) so that hashes for one user wont' work for another