A password database is only as safe as its hashing scheme, because once hashes leak, attackers can shift from online guessing to offline cracking at machine speed.