[rndgermandude]

>only true in an edge case

Sorry, when it comes to passwords, in particular plain text ones, this is not good enough.

Then you repeatedly say "hashes", which may mean anything from md5 to argon2id and whatever. Given that Okta stores plaintext in some cases, the generic use of the term "hashes" is a bit of a red flag to me, to be honest.

[jf]

Okta uses bcrypt for hashing passwords, extra details can be found here: https://www.okta.com/resources/whitepaper/okta-security-tech...