system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Why should I worry about a hacker getting passwords from a website, if the passwords a supposed to be hashed anyway?

I'm a web dev and when I build a authentication system passwords are hashed so they can't be read from the database. How would a hacker obtaining passwords help them with this limitation?
gpt
Three reasons, really.  First, as the end user, you don't actually know that the passwords were hashed at all. All too often we find out that a site was storing passwords as cleartext only *after* an intrusion gets revealed.  Or they might be hashing passwords but *also* leaking a cleartext copy of it somewhere. It's happened countless times in our short history.

Second: As others have pointed out, a web site may have hashed passwords but failed to "salt" them. For any given hashing algorithm, this would mean that any password maps to exactly one  *hashed* password.  They can then use a "rainbow table" to quickly look up each hash against this precomputed list of many billions of the most likely passwords: if your password is on the list, the hash will match and your password is revealed immediately.

If neither of the above are true, if the passwords are both hashed and salted, stealing the password hash still enables an *offline attack*.  The web site itself may limit how many attempts you might make to guess a password, or how quickly those guesses can be made: but if the hacker has your hashed password he can test likely passwords against the hash as fast as he or she can, with none of those software-imposed limits.  The remaining defense against this, other than two-factor authentication, is an algorithm that makes hashing the password very slow and costly. PBKDF2, Password-Based Key Derivation Function 2, is among the most well-known of these.