I am still very new to Information Security field and as far as I know, websites use hashing algorithm on user's passwords before storing it and they don't know the plain-text password of a user.

Today, I tried to change my Facebook password but I got this error,

enter image description here

Even I don't remember my old password so how could facebook know what was my old password ?


2 Answers 2


We do not know how exactly Facebook manages user passwords, however, we can imagine this scenario:

A new user logs into his Facebook account using the password: Password1. It is likely that, immediately, Facebook generates similar passwords such as: Passw0rd1. pAssword2, Passmord1 ...etc.

Facebook then stores their respective hashes (which are different, of course) so that if a user user types his password (after reset), the hash of the new password is compared to all these stored hashes: Facebook can tell you then if your new password is similar to the previous one or not.


Following @Philipp comment saying Facebook does not hash passwords, I want to share this information that I quoted from the official Facebook documentation (Keeping Passwords Secure):

We hash each password using our internal password hashing algorithm and the unique salt for that person. Since Facebook stores passwords securely as hashes, we can't simply compare a password directly to the database. We need to hash it first and compare the hashes.

  • 4
    but as far as I remember even if we change the single character in password, the entire hash is changed...isn't that true ? Oct 4, 2015 at 12:34
  • 2
    @Begueradj, but isn't it a bad security practice to store multiple hashes of user's similar password in your database ? wouldn't that make cracking password easier in case if your database is compromised ? Oct 4, 2015 at 13:01
  • 1
    maybe Facebook does it locally! I mean when you enter your password, the HTML page on your machine replaces some letters, hashes them and send the hashes. I think you should ask someone who is professional at HTML programming :/
    – Eibo
    Oct 4, 2015 at 13:02
  • 2
    HTML is not programming Oct 4, 2015 at 13:02
  • 1
    Web programming. whatever it is ... you got the point !
    – Eibo
    Oct 4, 2015 at 13:03

The technical details are given in brief but Facebook does use hashing with unique salts. The plain text passwords are hashed with undisclosed algorithm(as Facebook has not revealed it) and then prefixed or postfixed with unique salt and compare it. If it matches then the user gets the green light otherwise no. In case, of similar password, may be Facebook use pre-computed and predicted hashed passwords like replace a with @ or i with 1 or replacing alphabet/s with Upper or lower case. It's given here in brief.

Not the answer you're looking for? Browse other questions tagged .