How valuable is a password hash?