Store passwords as deliberately slow fingerprints, so a stolen password database is expensive to crack.
The idea: A website shouldn't store your password, only a fingerprint of it, so it can check logins without keeping the password. But fingerprints can be guessed: a thief with the database can hash millions of common passwords and look for matches. Password hashing makes every guess expensive on purpose, slow and memory-hungry, so millions of guesses per second become a handful. A random salt per user stops one round of guessing from cracking everyone at once.
Why it matters: Protects your password when a website gets breached.
Store passwords as deliberately slow, memory-hungry hashes (Argon2, scrypt, bcrypt)[1, 2, 3], so a stolen password database is expensive to crack offline.
It relies on preimage resistance plus the deliberate cost. Argon2 won the Password Hashing Competition in 2015[4, 5].
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.