A password hash is the result of running a password through a one-way mathematical function. A service stores the hash instead of the password itself, and when you sign in it hashes what you typed and compares the two. Because the function is one-way, the stored value cannot simply be reversed to reveal the password.

A leaked hash is not the same as a leaked password, but it is not harmless. Attackers can guess passwords, hash each guess and compare it with the stolen value, and weak or common passwords can be recovered this way. How hard that is depends on the hashing method. Slow, purpose-built password hashing algorithms with a unique salt for each user make guessing much more expensive, while fast or unsalted hashes can be cracked quickly.

What a breach means for you depends on how the service hashed passwords and how strong your password is. A long, unique password stored with a modern algorithm is far harder to recover than a short common one stored with a fast hash, and reusing a password makes a crack worse because it unlocks other accounts.

If a service reports that password hashes were exposed, change your password there and anywhere else you reused it, and enable multi-factor authentication. Service operators should use a modern password hashing algorithm with salts and force resets after an exposure.