How a Database Works

Imagine you’re a new user. Let’s start by creating an account.

As you can see, your id, username, and password now appear as a row in a table. This is how a relational database stores data: in tables made of rows and columns, a lot like a spreadsheet. To read or change that data, programs use a language called SQL (Structured Query Language). In simple words, SQL is the language programs use to find, add, change, and delete data in a table.

Now try logging in with the account you just created.

You’ll see one of three messages: User not found, Wrong password, or Login successful. Let’s see exactly how it works.

// Look up the user by username (a real website does this with SQL)
const found = hashedUsers.find(user => user.username === loginUsername.value);

if (!found) {
    // No user with this username
    loginResult.textContent = "User not found";
} else if (found.passwordHash !== await hashPassword(loginPassword.value)) {
    // Hash the typed password and compare it with the stored hash
    loginResult.textContent = "Wrong password";
} else {
    // The user exists and the hashes match
    loginResult.textContent = "Login successful";
}

Now, let’s say you’re a hacker. Press the button below to hack the database, and you’ll see your data exactly the way a hacker would. In real life, attackers break in through bugs like SQL injection. What they take out often looks like this.

That’s the problem: if a hacker breaks into a database, they can read the whole table. That’s why most websites never store your original password. Instead, they store a hash of it. It’s like writing your password on a piece of paper and putting it through a paper shredder, except this shredder always cuts the same paper into exactly the same pieces, and no one can tape them back together.

However, if you choose a simple password like “abc”, a hash won’t save you. Hackers already know the hashes of common passwords, so the moment they see yours, they know the original. That’s why many websites ask you to choose a complicated password.

Most websites also use salt. Just like salt adds flavor to food, a salt adds a few random characters to your password before it’s hashed. So even if two people use the same password, their hashes look completely different, and a hacker’s list of known hashes becomes useless.