eli5: What it means websites keeps their users passwords in hash form?

hard to de-scramble way

It's not hard, it's impossible. It's a one way operation.

For a very simple example of how math can be only way only, consider squaring. If you knew the operation was squaring, and you knew the result is 4, you know the answer, right? It's 2. Well, no, it might not have been. It could have also been -2. Some mass is one way, once done some information is lost that can't be undone. Hashed password can't be undone.

That said, they can still break it. If they have the hashes from a leak, they can just brute force strength guess until they get the answers. Not so much de-scramble, as just guess a lot until you get the right answer. Doesn't work if a system only gives you five tries before locking out, but if you steal the hashes you have unlimited tries. Still not easy or quick.

/r/explainlikeimfive Thread Parent