&gt; Only if you are using a weak hash like MD5. The primary point of hashing a user&#x27;s password is to make so that it cannot be easily cracked in the event of a DB breach&#x2F;leak. Stronger hashes require much more time, energy and computing power to crack...far more than what is realistically available today.<p>I&#x27;m not suggesting that they&#x27;d be able to trivially crack the password (nor am I arguing that password hashing shouldn&#x27;t be a thing - it certainly should be). I&#x27;m saying that it&#x27;s likely that if they can access the database that contains the user&#x27;s account details, they&#x27;re able to access other information that&#x27;s held in the system anyway (that&#x27;s what I meant by &quot;game-over&quot;).<p>&gt; Depends. You would need to know what hashing algos&#x2F;processes, initialization vectors, etc that are in place to create the DB hashes. For example, if they are &quot;salting&quot; the passwords, you would also need to have the salt token on hand.<p>I bet in a lot of cases (not all, would require open-signup etc), you could sign up for an account on the service using a known password, dump the hash of the known password, and swap out the hash of the privileged user. That way you wouldn&#x27;t need to know the details of the hashing implementation.