Yeah. It produces a response that’s small, easy and fast to generate, easy and fast to parse, without actually telling the server much of anything (all the serv

Yeah. It produces a response that’s small, easy and fast to generate, easy and fast to parse, without actually telling the server much of anything (all the server learns is that it isn’t a password whose hash starts with something else, but that barely narrows the search space).