How would you know any of this is real?
Every other demonstration in the estate shows prepared data, and says so. This one does the work while you watch: a signed policy decides the parameters, a secret inside a hardware module is applied, and every operation is appended to a record that can be proved without trusting us.
Walk it through
The policy in force
Hashing parameters are not chosen by the caller. They come from a signed policy the service loaded at startup, and a request names the policy it wants rather than the settings it wants.
Hash a password
This runs the algorithm named in the policy, with a secret pepper held in the hardware security module. The password is not stored, and the pepper is never read out of the module.
Check a password against it
The same computation runs again and the result is compared in constant time. Try the right password, then change one character and try again.
What those operations wrote
Every request appends to a log where each entry carries the fingerprint of the entry before it. Removing or altering an entry breaks the link to the next one.
Prove one entry belongs
Entries are sealed in batches under a single value derived from all of them. An inclusion proof is the short list of neighbouring fingerprints needed to rebuild that value from one entry.