No, this is totally insecure. You're supposed to generate a public/private key pair for the user, encrypt the hash with the public key and store the private key

No, this is totally insecure. You're supposed to generate a public/private key pair for the user, encrypt the hash with the public key and store the private key in a separate database on a separate server that isn't connected to the internet and doesn't allow remote log-in from the lan.