> I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Exactly the point of a salt, to ma

> I know many hackers maintain and run through databases of password+hashes they can fetch original passwords from the hash. Exactly the point of a salt, to make it so rainbow tables need to be computed with a salt which ideally is different for every user. The salt being exposed doesn't change that. Edit: For Google/Facebook sign-in, which I presume is OAuth, it works differently and they're correct in saying your Google or Facebook password is not at risk. So usually, I'd agree, but in this case it's fairly reasonable to say it's unlikely anything was accessed. Cracking bcrypt takes time. If the hackers wanted to target an individual, they'd just phish them. Also, they literally say: > As a precaution, we recommend changing your Canva password. https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/ https://support.canva.com/contact/customer-support/may-24-se...