Suppose we have a password hash function H and a finite set of passwords P. The goal is to precompute a data structure that, given any output "h" of the hash function, can either locate an element "p" in P such that H("p") = "h", or determine that there is no such "p" in P. The simplest way to do this is compute H("p") for all "p" in P, but then storing the table requires Θ(|P|"n") bits of space, where |P| is the size of the set P and "n" is the size of an output of H, which is prohibitive for large |P|.