>>The hashing is really simple. You can do a test of concept using your user name and applying a MD5 checksum, then you save this MD5 checksum on a variable.
>>Next time you enter a user name and obtain the MD5 checksum, you compare this checksum with the saved one. If they are equal, the password (whatever it is) is correct, otherwise is not.
>
>A bit oversimplified ;-)
>
>If the checksum is not identical, pwd is proven to be incorrect. There is a minimal chance that a hash collision happens - meaning a different source will generate the same hash result resulting in allowing some incorrect pwds.But the risk of storing pwd in clear is supposed to be greater than the risk of hash collisions with good hash functions.

Or, to say it the otherway around. The hashes has to be kept hidden the same way as a password. If the hash is known it's much more easy to guess a fitting password.A lot of the late hacks where possible because the hashes where stolen.