0x0 is saying that when you receive the password you can do 3 checks. No need to invert the hash function there.

Also, inverting a hash function is impossible (the size of the range is less than the size of the domain). Finding a collision, on the other hand, is not.