Never store plain-text passwords. This post explains hashing, salting, and how bcrypt helps protect user credentials even if your database is exposed.