Password hashing
Also called salt, Argon2id, bcrypt
Storing a scrambled form of a password that can't be turned back. At login you scramble what they typed and compare. It has to be deliberately slow, and salted with a random value for each user.
One day your database may be stolen. Fast hashes like SHA-256 let an attacker try guesses at enormous speed, and without a salt, two people with the same password show up as the same value.
Say it to your agent
“Hash passwords with Argon2id, 19 MiB of memory, 2 iterations, parallelism 1. No SHA-256, no MD5. Add a test that two users with the same password get different stored values.”