How does an operating system protect the passwords used for account logins?

Modern operating systems apply a one-way hash function, such as bcrypt or PBKDF2 with a salt, to each password before storing it in the credential database. At login, the system hashes the entered password and compares the result to the stored hash. Because hashing is computationally irreversible, even if the credential store is compromised, the original plaintext passwords cannot be directly recovered.

Hiding passwords in a secret file provides only security through obscurity and offers no cryptographic protection - an attacker with sufficient system privileges can locate and read any file on the system.

Symmetric encryption is a reversible process; if the decryption key is exposed or derived, all stored passwords are immediately compromised. Hashing is preferred precisely because it is a one-way function with no corresponding decryption operation.

Storing passwords in a specific memory segment is a physical isolation strategy that does not provide cryptographic protection - an attacker who gains access to that memory region can still read the plaintext values directly.