How does an operating system protect the passwords used for account logins?

A one-way hash function (such as bcrypt or SHA-256 with salt) transforms the password into a fixed-length digest that cannot be reversed. When a user logs in, the OS hashes the entered password and compares it to the stored hash - the original plaintext is never stored or retrieved, which means even if the hash database is stolen, the original passwords remain protected.

Storing passwords in a hidden file relies on security through obscurity, which is not a cryptographic protection and is easily defeated by an attacker with sufficient access.

Symmetric encryption is reversible, meaning anyone who obtains the encryption key can decrypt and recover all stored plaintext passwords - this is fundamentally weaker than one-way hashing.

Storing passwords in non-volatile memory without cryptographic transformation still exposes them in plaintext if that memory is physically or logically accessed.