Yes, it does. If I have a properly salted/hashed password dump, I can easily check common passwords against all users. Assume 5m users. The odds of finding any

Yes, it does. If I have a properly salted/hashed password dump, I can easily check common passwords against all users. Assume 5m users. The odds of finding any user with password: "Password2020" is pretty high. But you'd need 5m requests against the service to do the same thing. There's no rate limit on local, offline attacks. Are salted hashes better than, hashed, or plain text passwords? Yes! But there's still more attacks possible with access to the data. This gets much worse, if the password/secret is limited, say a 4 digit pin - or a social scurity/government id number with error correcting code (eg the Norwegian government ID is 11 digits, but 2 are error correcting, and 6 are a date - so it's pretty much impossible to store them hashed in a secure fashion. You only need to try 365.25 * ~60 years * 1000 numbers to find/recover all - a far cry from 10^11 - which is pretty low anyway). If the passwords are all truly random, well over 64 bits of entropy, and never re-used and/or leaked... then properly hashed, a dump would not leak much information. But there'll always be re-use, and at that point, exposing the salted hash along with a linked login name will expose information (of course, sometimes the login will be the same as well - but it's still valuable to know login is possible before trying to login to a service).