> they hash all possible passwords and test the resulting hash to see if it matches your hash. This is the key thing to remember. There is no requirement that

> they hash all possible passwords and test the resulting hash to see if it matches your hash. This is the key thing to remember. There is no requirement that the password cracker needs to find exactly the same thing you would type for your password, they only need to find an input that has the same hash as your password. You can think of it like an alternate password; there won’t be any way for the site to distinguish between the real password and the alternate(s). They key to a good hash algorithm for passwords is to make collisions rare (this is accomplished by making the hash longer than the average password; the more bits there are in the hash the rarer collisions will be) and to take a long time to compute (usually by adding rounds to force the attacker to take more time on each input).