I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored somewhere in the HTML?
I understand that what a hash is and its (assumed) irreversible manner. I also understand what salting a hash is.
The thing I am confused about is how does a website store these hashes securely enough so that someone cannot just go through the html and use something like hashcat to attempt to crack them. What are the security measures in place to prevent hashes from being found? And additionally, how can I know which websites securely store their hashes?