Storing passwords hashed rather than in plaintext is the right instinct reaching for the wrong tool. SHA-256 was built to be fast, because speed is what a checksum is for, and a modern GPU computes billions of them per second.
So when the database leaks, nobody tries to reverse the hash. They guess. Hash password123, compare it against every row in your user table, move to the next candidate, repeat a billion times a second.
Password hashing wants the opposite property. bcrypt runs deliberately slow — a few thousand guesses per second where SHA-256 gave a billion. argon2 goes further and is deliberately memory-hungry, so the GPU loses the parallelism that made it dangerous.
Then salt each password with a random value unique to that user, so the same password yields a different hash on every account and one cracked row reveals nothing about the next.
Logins now cost about 100ms of CPU instead of microseconds. That expense is the feature.