Passwords are hashed, not encrypted.
What Happens to Your Password?
Follow a password through signup and login. A responsible service stores a unique salt and a one-way derived hash, then verifies future attempts by running the same computation again.
login = compare(stored_hash, new_hash)
Password Lab
Your input stays in this page. The hash is computed with Web Crypto in your browser.
Avalanche Effect
Change one character and the output becomes unrelated.
Current password
One-character change
One-Way Pipeline
Easy to compute forward. Hard to reverse except by guessing.
Password
The secret goes into the function. A login system can check it later without storing the original text.
Salt + Cost
The salt makes equal passwords store differently. The cost makes every guess slower.
Stored Hash
This is safe to store because it does not contain a reversible copy of the password.
Stolen Database Attack
The attacker steals the stored record, then tests password guesses against it.
Run the attacker to test common passwords and simple variants. Strong secrets survive this tiny demo budget because the only route back is guessing.
What the stolen record may reveal: