If I breach your environment and get access to bcrypt hashes, they are useless to me as-is.<p><i>If</i> I have enough processing power to brute-force compare them, I can eventually get the original password back, but that isn&#x27;t a zero-cost effort in terms of time. As soon as you realise you have been breached, I would expect you would have initiated a lockdown of some kind, either preventing access to accounts until the owner can confirm identity, or forcing a password reset for all users.<p>If you store passwords in plaintext, I can copy the passwords, and impersonate users even while they continue using their accounts, unknown to them.