Stefan Mileschin

“Our password database was stolen yesterday. But, don’t worry — your passwords are completely safe.” We regularly see statements like this one online, but should we really take these assurances at face value?

The reality is that password database compromises are a concern. However, if you use unique passwords everywhere, you shouldn’t need to worry too much.
How Passwords Should Be Stored

Here’s how passwords should be stored in an ideal world: You create an account and provide a password. Instead of storing the password itself, the service generates a “hash” from the password. This is a unique fingerprint that can’t be reversed. For example, the password “password” may turn into something that looks more like “4jfh75to4sud7gh93247g…”. When you enter your password to log in, the service generates a hash from it and checks if the hash value matches the value stored in the database. At no point does the service ever save your password itself to disk.

http://www.howtogeek.com/171236/why-...ase-is-leaked/