How websites check your password without ever storing it

A well-built website never saves your password. It saves a hash: a fixed-size fingerprint that's quick to compute and impossible to run backwards. At login it hashes what you typed and checks whether the two fingerprints match.

Type into a live SHA-256 hasher, watch one changed letter scramble the whole output, and look at a leaked user table to see why every user gets a random salt. Then find out why real sites use deliberately slow hashes like bcrypt and Argon2, and how much time that buys against an attacker's guesses.