> Peppering is a token that is not in the database of passwords that needs to be applied for the password to be correct.
Well, typically a server only cares about verifying the user (still) knows a password.
A typical server (today) does not have a way to reconstruct the plain password, only a way to check if any given string matches.
A password manager, typically does have a way to supply the password.
Peppers and salts are typically manipulated by the server system, plain passwords are typically managed by the password manager.
In this case the password manager never sees the hocrux, and cannot leak it. A server will typically leak a pepper to anyone with access to ram (or access to a hw enclave, which is expected to be more difficult).
