Sure - in this specific case I was referring to &quot;any attacker who snags the server&#x27;s database&quot; - I was taking snags the server&#x27;s database to mean &quot;has full DB dump&quot;, which perhaps was not sillysaurus3&#x27;s intention.<p>I agree that if the only information you have is a users password hash then your options beyond attempting to brute-force the hash are limited (unless the system was vulnerable to a pass-the-hash attack, of course).