You'll want to ofc 'salt' users passwords ahead of hashing them to avoid being able to recover the original password from the hash. $endgroup$ Whilst you can steer clear of collisions by using a cryptographic hash, this isn't completed in exercise mainly because cryptographic