This question already has an answer here:
I am setting up a website to help people with certain niche interests find each other. It is being done purely as a voluntary project, there is no money involved (on either side), nor is there much personal information stored. The only interesting data we store is the postcode, email address and password (hashed) of each user. All that would be gained by having access to these is the ability to change the user's postcode, which seems to me to be of little benefit to anyone.
However, it has been pointed out that many people use the same password everywhere, so if someone could access the data, they would be able to try the same email/password combination on other sites. Whilst this seems like a small, and probably futile task, we want to reassure our users that we are protecting them.
P.S. Please note that I'm not a security expert in any way, so please don't assume any prior knowledge. If I've missed some obvious point, please clarify it or ask for more details, rather than downvoting as a bad question. I did search around, but haven't really found anything that answers this question (although I learnt a lot of other things along the way!)
P.P.S. Please note that this question is specifically related to the register and log in process. There are obviously questions of database security, etc, but they are being dealt with separately.