I've spoken to an employee of a big international company in germany.
He said, employees are warned if their new password is too similar to the old password. (e.g. if they change the password from
The aim of using hashing functions is to not be able to tell the difference between a password and a random string.
As they can tell if the difference is too small, they have to save at least one password in cleartext.
The employee said they use Windows/SAP systems (and the warning occours on all systems)
My Question is therefore if my analysis is correct or where my error is. As they hire also lots of computer science people, i would guess the error relies on my side, not theirs.