Which statement best describes the relationship between hashing and password verification?

• A. The plaintext password is stored directly for verification
• B. A salted hash is compared to the stored salted hash to verify a password without revealing it
• C. Passwords are encrypted with AES and stored
• D. Verification requires sending the password to the server in plaintext

Answer: (B)

Password verification hinges on hashing with a salt, not on handling the actual password. When a password is created, the system stores a hash of the password combined with a unique salt. Later, the user enters the password; the system applies the same salt and hashing process to that input and compares the new hash to the stored one. If they match, the password is correct without ever exposing the original password. The salt ensures that even identical passwords produce different hashes, protecting against rainbow tables and precomputed attacks. Storing plaintext passwords is insecure, encrypting with AES would imply decrypting to verify, and sending the password in plaintext over the network would expose it to interception.