Picture the worst morning of your career: a copy of your production database is sitting on a forum, for sale, and you find out from a customer.

If your app authenticates with passwords, that morning is a catastrophe. Even with bcrypt, an attacker now has every hash to grind offline, every reused password to spray at other sites, every "forgot...