system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Brute force attacks on passwords

Why can I lock myself out of an online account knowing the password but doing it wrong three times but a hacker can brute force possibly millions of attempts?
gpt
The 3 wrong passwords=lockout function is a protection against brute-force attacks, and it's been a long time since hackers have been doing those attacks on login forms.  Instead, they are sometimes able to steal a list of *unsalted password hashes* from sites with poor security practices.  They are then able to run a brute force attack against that entire list, entirely on their own computer, and determine what passwords produce hashes that match the list.

> **hash**: For security, companies do not (well, should not) store your actual password.  Instead, they use a mathematical algorithm to mutilate your password in such a way that it can't be reversed.  The resulting value is the hash.  Then, when you log in, they mutilate the password in the same way and see if it matches.

> **salt**: For additional security, when you set the password, the system generates an additional random value and adds it to your password before it is hashed.  This value is saved and used whenever you input your password.  This makes it so that if someone steals a list of hashes, he has to re-hash each password for each account, instead of checking each password against the whole list at once.