If you have an account on a website that is hacked, it’s a very good idea to consider that password publicly known. This also means that to work out a password, hackers must guess passwords until they find the one where the output matches. This means that the website can check if you’ve provided the right password by hashing it and comparing the output to the one saved in the database, all while not knowing the original password. The “one-way” part is also important, this means you can’t take the output of the hash function and transform it back to the original password. A hash is a one-way function that always creates the same output if you give it the same input and will provide a different output for different inputs. Ideally, websites should be cryptographically hashing passwords before saving them in the database. If they’ve got a list of email addresses and associated passwords, they can try to use them on other websites where it may be easier to make or steal money. Account details are a big interest point for hackers specifically because so many people reuse passwords.

In the worst-case scenarios, this vulnerability allows hackers to download the website’s database, which will include every user’s account details. No one’s cybersecurity is perfect, this, unfortunately, means that websites are not as secure as they could be.

Data breach google chrome passwords