You should ofc 'salt' users passwords prior to hashing them to avoid with the ability to Get well the original password from the hash. $endgroup$