Yes, it is! Since DDG does it quick, I'll use MD5 as an example, but don't ever use MD5 as your hash! An attacker already knows a user's plaintext password is

Yes, it is! Since DDG does it quick, I'll use MD5 as an example, but don't ever use MD5 as your hash! An attacker already knows a user's plaintext password is "pass123" and no salting has occurred. He can search for "32250170a0dca92d53ec9624f336ca24" in the database and find 5 other users that have the same hash. He now knows that those 5 people have the same password. Meanwhile: Johnpass123: e3445c82086cff25a79dcbbe59b569d1 Mattpass123: fd6d563970fd6ead6391a997a5e06d80 Moral: It's not about how hard it is to crack. It's about comparisons of hashed values without cracking necessary.