Hacker News Reader

Since hash functions are fixed-length, aren't there always infinitely many collisions and therefore passwords which would work?

In theory yes, but finding SHA1 collisions is nontrivial. shattered.io has one, but they used up quite a bit of compute to get it.

Unless it's invertible.

Hash functions can't be invertible due to pigeonhole principle, as there are more possible inputs than possible outputs for a fixed-size hash.