In my school everyone must change their password every six months.

The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need to use a different password almost entirely because they cannot choose a new password in which only a few characters differ from the old password.

Isn't this a sign of unhashed password storage, or have I overlooked something?

If this was the case, I'd be really surprised. Nearly every computer in the country uses this management system.

merged by Rory Alsop Mar 23 '14 at 22:57

This question was merged with How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? because it is an exact duplicate of that question.