What you need to know
Passwords are guessable and reused. A slow, salted password hash makes large-scale guessing more expensive if the database is exposed, while plain SHA hashes are designed to be fast.
How to apply it
Use a maintained authentication library and a password hashing algorithm such as Argon2id or a well-configured bcrypt implementation. Let the library generate unique salts and verify login attempts safely.
Common mistake to avoid
Do not invent your own hashing scheme or store a reversible password value. Keep rate limiting and secure recovery flows in place too.