I don&#x27;t quite follow. If they have access to the server&#x27;s database, then unless the rest of the DB was encrypted using a key derived from the users password, will they not have access to all the accounts anyway?<p>(edit: I should perhaps make it clear that I&#x27;m not suggesting that passwords shouldn&#x27;t be hashed, merely that if you have access to the database containing the password hash, then in many cases you&#x27;d <i>already</i> have access to the data that knowing the password behind the hash would provide).