You must ofc 'salt' users passwords just before hashing them to stop with the ability to recover the original password from the hash. $endgroup$$begingroup$ As hashes are fastened duration, does that mean that although not specified when creating the password, all login units would need to have some sort of maximum input duration (Though likely inc