&gt; if you can get a copy of the password hash from a database dump is it not pretty much game-over anyway?<p>Only if you are using a weak hash like MD5. The primary point of hashing a user&#x27;s password is to make so that it cannot be easily cracked in the event of a DB breach&#x2F;leak. Stronger hashes require much more time, energy and computing power to crack...far more than what is realistically available today.<p>&gt; If you&#x27;re able to perform SQL injection against the DB, would you not be able to change the password in order to gain access to the system, or grant admin privileges to your own accoun<p>Depends. You would need to know what hashing algos&#x2F;processes, initialization vectors, etc that are in place to create the DB hashes. For example, if they are &quot;salting&quot; the passwords, you would also need to have the salt token on hand.