Passwords are never stored

The one rule: never store the real password

If PawWalk's database is ever stolen, the attacker must NOT get everyone's real password. So the backend never stores what you typed — it stores a hash: the one-way scramble of it. hash("correct horse") always produces the same scramble, but there's no unhash() to run backwards.

A salt — random bytes mixed in before hashing — makes sure two users with the same password get different stored hashes, so an attacker can't precompute one giant table of common passwords and match it against your whole database. The hashing library below generates and stores the salt for you, bundled right into the hash string.

This is exactly what Part I's auth module assumed was happening on the other end of /auth/signup. Now you see it.