Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received the password in my e-mail in plain text.

I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?

  • 20
    Yes! Yes! Yeeeeeeeeeeeeesssssssssssssssss!
    – ewanm89
    Oct 29, 2012 at 22:27
  • 4
    They could encrypt (probably aren't though) it in the database, but a decryption key is going to be available to that server. Finally, an email on the wire is not secure.
    – ewanm89
    Oct 29, 2012 at 22:28
  • 10
    – Mormegil
    Oct 29, 2012 at 22:37
  • I applied to become a graduate InfoSec consultant and this happened to me! I quickly revoked my application!
    – LukeJenx
    Oct 30, 2012 at 11:47
  • Out of curiosity, are you getting your password back in plaintext? Or is it a new password?
    – Randy E
    Nov 1, 2012 at 22:22

4 Answers 4


Yes you should be concerned if you use the password on other websites or have personal data stored on it. This is one of the reasons you have to have different passwords for every website. They are storing your password plain text. I'd stay away from with personal data. It's one of those basic security principles they violated, chances are that there will be more.


You should be concerned only if you care about other people accessing your account on that site. Not only because they're storing your password in plaintext in their database, and not only because they've sent your password in the clear via email, but also because they obviously don't care enough about securing your account to make even a minimal effort.

What you should do in such a case is report them to http://plaintextoffenders.com/. This is a Tumblr site which collects evidence that various sites store passwords in the clear. The goal of this site isn't just the LULZ, but also to warn users of this issue and to shame the sites into mending their ways.

  • 1
    Some of those aren't necessarily storing passwords in plain text. Just because you e-mail the password upon registration (which I'm not claiming is a good idea) doesn't mean you're storing the plain text password in the database. Oct 30, 2012 at 14:04

Yes, you have to. If a tool can send your password, it means that your password is stored somewhere in a format, which is finally human-readable. Don't trust in that application or system.


Well for having the password stored in plaintext in their database: If they email you a new password instead of your old one, then maybe they just generated a random password, salted, hashed and stored it but if they email you your own password then yes definitely stored as plaintext!

  • In either case the password is being transmitted in plaintext which is the core of esqew's question.
    – Scott Pack
    Nov 1, 2012 at 20:53
  • @ScottPack yes, that is right, but my answer was intended for the 2nd part: "I would imagine that to make this possible, the password would have to be stored in plain text somewhere in the database. Is this necessarily true?" Mar 7, 2013 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .