If it is possible to locate a shorter password which hashes into the same worth as a longer password, the hashing algorithm is damaged. $endgroup$ It should be CPU-major to make brute force assaults more challenging/unachievable, in the event that your database would be leaked. The Murmur3