Hashing isn't to avoid someone guessing, but to avoid leaking thousands of passwords when you db get stolen. Even if someone got the db, and managed to get the

Hashing isn't to avoid someone guessing, but to avoid leaking thousands of passwords when you db get stolen. Even if someone got the db, and managed to get the hash of a certain character combination, they'd need to get the exact one that the bank prompts for on the next login attempt.