You should never be able to read a user's password, including yourself. At signup you run it through a hashing function and store only the result. At login you hash what the user typed and compare. A salt, a random value stored with each hash, makes identical passwords produce different hashes, which defeats precomputed lookup tables.
The function matters. General-purpose hashes like MD5 or plain SHA-256 are built to be fast, which helps an attacker guess billions of passwords per second. Password hashing algorithms are built to be slow and memory-hungry. OWASP recommends Argon2id first, with scrypt, bcrypt, or PBKDF2 as alternatives depending on constraints.
AI-generated auth code sometimes uses a fast hash, stores passwords in plain text, or invents its own scheme. Do not write this yourself if you can avoid it: use your framework's built-in support or a managed auth provider. If you must handle it, use a maintained Argon2id or bcrypt library with recommended settings, never log passwords, and rehash on login when you raise the cost settings.
import argon2 from "argon2";
const hash = await argon2.hash(password, { type: argon2.argon2id });
const ok = await argon2.verify(hash, attempt);