Hash, not encrypt. And &quot;Should&quot;, yes. &quot;Did&quot; maybe not so much. Or to weak password&#x2F;hashing algorithm combination, so it could be brute-forced. But if I remember the 000webhost dump was cleartext.