Empty passwords are not hashed. Avoid empty passwords anyway by using validation.