From what I understand, in most sites, passwords are stored as a hash; not in their original form. This means that if the database is hacked into, the attacker will see the (nearly) useless hashes instead of the actual passwords.
For the website to authenticate your login attempt, it hashes your attempt of a password, and checks if it matches the stored hash. If they match, it logs you in, otherwise, it denies it.
I've read on many sites though that no hash algorithm can produce 100% unique hashes; collisions will always happen.
Does that mean that, theoretically, there exists another password that will give the same hash given a hash-function, which means there is potentially more than 1 password that could be used to log in with (although the other password would probably be near-random for a complicated hash-function)?