There are considerations on the performance as well. Usually, a responsible website will password-hash the plain-text password into a hashed string before savi

There are considerations on the performance as well. Usually, a responsible website will password-hash the plain-text password into a hashed string before saving the hashed string into their storage. Password-hash is a special hashing process designed to be reasonability slow, so an attacker who somehow obtained the hashed string cannot easily collide the hash with another plain-text. Some password-hash configuration can took few milliseconds to run, that's really expensive if you have to do that for every request just so you can compare the client password-hash v.s. the one stored on your server. (Full disclosure, I designed few session manage systems for my job before :D)