You're talking about a completely different problem.<p>Yes, many users pick crappy passwords.  That's a social problem, one that is difficult to address with technology[1].<p>Storing passwords on the server is unrelated to whether or not the user picked a good password.  If an attacker gets ahold of a copy of your database, they will have a much easier time of turning SHA1 hashes of passwords into actual passwords than of turning bcrypt-encrypted passwords into actual passwords (the latter being orders of magnitude more difficult, maybe to the point of being impractical as a target vector).<p>[1] You can always do things like require certain types of password complexity: minimum length, choice of characters from different character classes and cases, etc.  But then you end up just moving the problem elsewhere: instead of using the crappy password they remember, the user has to write down their complex password, or maybe even store it in a text file on their hard drive.