

Because, the hashing function is used before comparing.
- Stored hash is “5f4dcc3b5aa765d61d8327deb882cf99”,
- user sends “password”,
- system runs the hash on “password” and gets “5f4dcc3b5aa765d61d8327deb882cf99”,
- it matches, access is granted.
If the user sends “5f4dcc3b5aa765d61d8327deb882cf99” the system runs the hash on that and gets “696d29e0940a4957748fe3fc9efd22a3”. Those don’t match. No access.











Look at OPs history. It’s full of this crap.