Why Websites Can't Tell You Your Original Password: Hashing & Salting Explained

In the online world, passwords are the first line of defense for account security. Yet when users forget a password, sites never email the original password — they force a reset. The reason is not inconvenience; it’s that properly designed systems do not know your original password at all.

Websites Don’t Store Your Password Directly

If a site saved your raw password (e.g., Password123) in its database, a single breach would expose every account. Because many people reuse passwords across services, one leak could compromise email, payment, and other accounts. Therefore, secure sites transform the password before storage.

What Is Password Hashing?

A hash algorithm converts arbitrary‑length input into a fixed‑length string. For example, hashing Password123 with SHA‑256 yields:

008c70392e3abfbd895580c54e0999b5cb3708df7a4d5c7c7c2ea4565c83b16c

The site stores only this hash. On login, it hashes the entered password and compares the result. Real‑world systems avoid plain SHA‑256 and use dedicated password‑hashing functions such as Argon2, bcrypt, scrypt, or PBKDF2.

Key Properties of Hash Algorithms

Deterministic Output

Same input + same algorithm = same hash. This lets the site verify a login by recomputing the hash.

Avalanche Effect

A tiny change produces a completely different hash. Password123 and Password124 generate unrelated hashes, preventing attackers from guessing patterns.

One‑Way Computation

Hashes cannot be reversed to obtain the original password. That is why the site cannot tell you your old password.

Hashing Alone Is Not Enough

Attackers pre‑compute hashes for common passwords (rainbow tables) and compare them against leaked databases. Simple passwords like 123456, password, qwerty, abc123 appear in every dictionary. If two users pick the same password and the site uses identical hashing, their stored hashes match, revealing the shared secret.

What Is a Salt?

A Salt is a unique random value per user. The site combines the salt with the password before hashing. Example: Password123 Salt for this user: randomSalt The hash of Password123 + randomSalt differs from the hash of Password123 + anotherSalt. Even identical passwords yield different stored hashes. The salt is stored alongside the hash; its purpose is not secrecy but to defeat pre‑computed attacks.

How Login Verification Works

Step 1: User Enters Password

The user submits username and password.

Step 2: System Retrieves the Salt

The site looks up the salt and stored hash for that account.

Step 3: Recompute the Hash

Using the same algorithm, the site hashes the entered password with the retrieved salt.

Step 4: Compare the Two Hashes

If they match, the password is correct; otherwise it is rejected. The raw password is never stored or viewed.

Why Password Reset Is the Only Option

Because the database holds only irreversible hashes, the site cannot recover the original password. After verifying the user’s identity (via email, SMS, etc.), the site lets the user set a new password, then generates a fresh salt and hash to replace the old record.

Beware of Sites That Can Reveal Your Original Password

If a site emails your actual password, it likely stores passwords in plaintext or uses reversible encryption. A breach of such a site exposes every user’s real password immediately — a serious security flaw.

Are Hashed Passwords Absolutely Safe After a Breach?

Hashing and salting raise the cost of cracking, but weak passwords remain vulnerable. Attackers can still brute‑force or dictionary‑attack common patterns:

12345678
admin123
password123
手机号
姓名加生日
连续数字

Thus password strength depends on both the site’s storage method and the user’s choice.

How to Create a More Secure Password

Use sufficient length and avoid personal information (name, birthday, phone, ID fragments) or common words. Prefer multiple unrelated words or a password manager’s random generation. Never reuse passwords across important accounts. Enable two‑factor authentication (2FA) on email, payment, and social accounts so a leaked password alone cannot grant access.

Conclusion

“Reset password” instead of “view password” exists because secure sites store only salted, one‑way hashes. Login works by recomputing and comparing hashes, never by reading the original password. When you see a reset prompt, it signals the site follows modern password protection practices — not a missing feature.