In theory, passwords should not be stored in plain text and also it should be avoided to store them as a simple hash, something like
But once the database/file with passwords has been compromised for example a file containing data like this:
id, password 12, $2a$10$zkeaH43RM9Ep5.KPcyXWYuCaVSbKmmXaKLztvCa0G867ItEpvx4fa (bcrypt) 12, 05ffaebcca41770af425d4ba9b4e7bcdff532237dca931c192a36d94db7307d4 (scrypt) 12, JDJhJDEwJHprZWFINDNSTTlFcDUuS1BjeVhXWXVDYVZTYkttbVhhS0x6dHZDYTBHODY3SXRFcHZ4NGZh (base64 ofuscation bcrypt)
As an attacker, from the first look, I can see that in first case bcrypt with a cost of 10 is been used, for the second I have just a length of 64 in where probably salt is included, the third one ends being the base64 just obfuscating bcrypt
just to mention some random examples.
So once this information has been compromised, besides following a procedure for changing password etc, what could be the best way to store the passwords that at least could delay more the process of finding how it was generated and have more time for allow all users to reset/change passwords.
Or asking different, while having this kind of data what an attacker normally start to do? and based on this what could be improved so that it could be more difficult to find a pattern, start cracking the passwords, etc.