Plus: even with Argon2, dump + reuse of the same password elsewhere is still the quiet killer — unique passwords + a manager beat a perfect hash if the next breach is some random SaaS that still stores MD5.