I just logged into cPanel and when I click to change my password it asks me for three things:
- My old password
- A new password
- Confirmation of the new password
It also says that the old password cannot be empty.
This may not be exactly how cPanel does it but, it is a possibility:
- Since you have sent it your old password to cPanel it can hash it and see if it is equal to your password while still storing a copy of your unhashed password (in memory not on disk)
- Now since it has confirmed your old password hashes to the correct value it can perform tests on the plain text version (that you just barely sent it) and give an error if one of the tests fails
- If the new password and confirmation match store the new password.
Answer as to why it knows your old password:
You just gave it to it so it knows your previous password and stores it in RAM (not on disk). This is assuming that you are referring to your last password (the one that you're currently changing) and not to one that you used in a prior iteration.