>A hash algorithm is not a supernatural function which changes the metaphysical character of data. Again with the condescension. >And to the server in this ex

>A hash algorithm is not a supernatural function which changes the metaphysical character of data. Again with the condescension. >And to the server in this example, 200820e3227815ed1756a6b531e7e0d2 and qwe123 are exactly equivalent strings. Except they're not, because the former is presumed to be salted client-side, and it is not always true that the attackers [who have compromised the server in some manner] will end up knowing that salt. There are innumerable schemes that can render gaining knowledge of the salt difficult if not impossible, especially in the case of a server exploit that's limited in scope.