Passwords, salt and slow hashes

New idea

A leak of fingerprints still leaks

A site stored only password hashes, then its database leaked. Safe, right? Not quite. The same password always gives the same hash, so two users with the same hash have the same password.

Worse, attackers prepare in advance. They hash millions of common passwords once and keep a giant lookup table from hash to password. Spot 5e884898… in the leak? The table says it is password. Cracked instantly.