It goes without saying that sensitive information such as passwords or pass phrases should never be stored in plain text in the database in the first place. The common practice is to hash the user password and store the hash string of the password in the database. When the user tries to log in and supplies his password, it is used to generate a hash string to be compared to the one stored in the database. If they are identical, the password is the same because the chance of 2 distinct strings having the same hash string is so low that it’s mathematically impossible.
