This question already has an answer here:
I was forced to changed my password to an account (large institution) and it had a rule that the new password cannot contains a series of 4 consecutive characters that were in 10 previously used passwords. For example, if my current password had the sequence "abcd", the next 10 passwords cannot contain "abcd".
My first guess is that the institution is storing 10 previous passwords in a decodable manner. My question is thus: is there any way they could be doing such a procedure in a secure manner?
In another question we have a comparison to the current password which would be provided by the user, but it doesn't deal with 10 (!) previous passwords.