How does an operating system protect the passwords used for account logins?

A one-way hash function (such as bcrypt, SHA-2, or PBKDF2) transforms the password into a fixed-length digest that cannot be mathematically reversed. During login, the OS hashes the entered password and compares it to the stored hash - the plaintext password is never stored or transmitted. This ensures that even if the hash database is stolen, attackers cannot trivially recover the original passwords.

Storing passwords in a secret file relies only on obscurity and access controls rather than cryptographic protection, and an attacker with sufficient privileges or a path traversal vulnerability could locate and read the file directly.

Symmetric encryption is reversible with the decryption key, meaning a compromised key or algorithm weakness would expose all stored passwords, whereas one-way hashing provides stronger protection because no decryption step exists.

Storing passwords in protected non-volatile memory provides physical and access-control protection but does not prevent exposure if that memory region is read by privileged processes or through hardware-level attacks.