Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text.

I sent the company an email questioning their password handling procedures, but they claimed it was watertight.

My question is: When they send me my password in clear text does that mean they are actually storing it in cleartext (or in a easily reversible cryptographic way)?

I thought the whole point was that the password was hashed in a non-reversible fashion?

share|improve this question

marked as duplicate by Adnan, Xander, Eric G, Steve, John Deters Mar 25 at 17:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Yes, it absolutely means that they store your password in the cleartext or at least in a reversible way, e.g. encrypted. As to whether this is secure is a completely different question, because we don't know anything else about their infrastructure and policies in place. –  Karol Babioch Mar 25 at 13:39
I'm coming to the conclusion that the password is stored in plain-text, which means that an intruder to their system would have access to every users password. The security to prevent this is unknown. The unforgivable offense here is mailing the password back to the user in clear-text. –  Martin Mar 25 at 13:44

1 Answer 1

It is not as secure as it most likely should be, though there are occasional justifiable reasons for storing a password in clear-text (for example, unattended third party service access when authorization token's aren't an option).

It is certainly not secure to provide the decrypted password back to the user EVER.

share|improve this answer
Someone who occasionally comes around the site here actually runs Plain Text Offenders which attempts to shame such companies in to fixing their practices and explain to them the error of their ways. –  AJ Henderson Mar 25 at 13:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.