cryptographic passowrd storage use both a HASH, not the password, and a SALT, to avoid rainbow-table attacks. Rainbow tables can be downloaded on internet for all combinations of passwords up to 11 digits in length, longer requires brute force (years) a SALT on the hash makes all rainbow tables useless if the SALT is proper a proper solution for Q would be to use the OLD comparison to the old hash and THEN ask for q to update password,. That would require two lines of code and a higher IQ i guess.