I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain text. I presume this means that they have stored my password in plain text.

Is there anything that I can do to either improve their security or completely remove my details from their system?

UPDATE: Thanks to everyone for the advice. I emailed them, spelling out what was wrong and why, saying that I will be writing to the DP commissioner and will be adding them to plaintextoffenders.com.

I got a response an hour later: an automated message containing a username and password for their support system. Oh dear...

12 Answers 12


There isn't really much you can do, other than contact the website and try and explain them how bad of an idea and practice it is to store (and email) passwords in plain text.

One thing you can do is report any offending site to plaintextoffenders.com - a site (currently a tumblr blog, but we're working on a proper site soon) which lists different "plain text offenders" - sites that email you your own password, thus exposing the fact they either store it in plain text, or using a reversible encryption, which is just as bad.

With everything that's happened with Sony, again and again, people become more aware to the dangers of sites storing sensitive details unencrypted, yet many still aren't. There are over 300 sites reported, with more reports coming every day!

Hopefully, plaintextoffenders.com helps by exposing more and more sites. Once this gets enough attention on twitter or other social media, sometimes sites change their way, and fix the problem! For example, Smashing Magazine and Pingdom have recently changed the way they deal with passwords, and no longer store nor email the passwords in plain text!

The problem is awareness, and I hope that we help the cause with plaintextoffenders.

  • 7
    As I am based in the UK would I be able to suggest that they are in breach of the data protection act? – jamesj Sep 13 '11 at 19:04
  • @jamesj: I really don't know, unfortunately! – Igal Tabachnik Sep 13 '11 at 19:07
  • 1
    Nice idea with this site! Once you move to a proper site (or even before, if possible) you could add a section of "converted offenders". I hope that such a section would not stay empty and be an additional incentive for sites to fix their problems. – Joachim Sauer Sep 14 '11 at 6:03
  • 1
    @jamesj IANAL, but it looks like it may breach the seventh principle (see "accidental loss" in 9a). – deizel Sep 14 '11 at 12:08
  • @jamesj - it's certainly worth letting the DP commissioner know; try to write a short clear easy to understand letter (on real paper) for them. Don't expect too much though. :-( – DanBeale Sep 14 '11 at 18:47

Storing a password in plaintext is not really an issue -- at least, much less so than sending the said password in a plaintext email !

This email just proves that the web site administrators are not very careful with the information you entrust them with, and that's a good reason not to entrust them with any more data.

  • 1
    Can you elaborate a bit on why it's not an issue? I (along with millions of others) have a strong pwd that I use for many things. If everyone is doing their job and hashing then should I have to worry about my PWD being in plaintext and a disgruntled employee seeing it and using it to get into any one of my many accounts (My bank/other important passwords are different because of this). But making passwords visible to anybody seems like an issue and I'm curious as to why you say it's not because you are in fact the resident expert :) – Dan Drews Apr 16 '14 at 16:54
  • 8
    As I said, it is less an issue than the sending out as an email. But this highlights the need for site-specific passwords. I never use the same password for two distinct services -- and you should do the same, because you cannot know how (in)competent the sysadmins of any site are. They may store the password in plaintext, or, even worse, send it by email to poorly validated addresses. – Thomas Pornin Apr 16 '14 at 17:13
  • 6
    Storing the password in plaintext is a huge issue. LinkedIn got their credentials database stolen and over 6,000,000 user accounts were compromised. Those passwords weren't even stored in plaintext, but were hashed with SHA-1 without "salt." HOWEVER; I profoundly agree with you that this practice means that site is not worthy of you entrusting any more data with them. – Craig Aug 16 '15 at 18:21
  • Storing plaintext passwords is absolutely an issue. Who knows how many employees have access to their databases who are one bad day away from abusing all those plaintext passwords. The company does not need to know and should not know any user passwords. Period. – Nathan Adams May 26 at 16:51

Use a different password for each site. That way, when the password is compromised (whether by snooping on plaintext email transmissions, or even if a database with properly hashed/salted passwords is cracked), the attacker will only be able to access your account on that one site, rather than on all sites on which you have similar account credentials.

...and so you don't have to remember a zillion passwords: Stanford's PwdHash is a handy browser extension that automatically generates unique passwords by hashing a common password you enter with the site's domain.


Send them one email asking to be removed from their database.

Don't give any more information about you to them

Be sure to not have that password used anywhere.

  • 2
    I have the feeling that anyone so negligent about security would, at the most, mark your database entry as inactive. I don't see any way to have assurance that your plaintext password is no longer available to all and sundry--the easiest way would probably be hacking in and deleting it. – user502 Sep 13 '11 at 18:32
  • perhaps changing the password a thousand times, just in case it's stored somewhere to prevent that "don't repeat your last 3 passwords" – woliveirajr Sep 13 '11 at 18:52
  • 1
    @woliveirajr Doing it a thousand times would probably trigger DoS protection. – forest May 24 at 0:22

That's why it's recommended to use another password on each site.

Try to e-mail them to delete your account. Otherwise do not use that site and really, use/generate another password (and long one!) on each site you're registering to. You never know which ones store plain passwords into their database

  • +1 For recommending unique passwords on each site. – Mox Sep 15 '11 at 1:25

I would say since the password is out there for the world to see, just update it to a password that you are not using anywhere else. Thus no one can hack your information on any other site using the password on this site. Example could be if your email is your login and you are using the password on this site as a password for your email.

Other than that,if you would like to offer to help the website with storing passwords effectively and send them the link of this stackoverflow thread.


If it's transmitting passwords in plain-text, it's a "vulnerability".

The first step is to find proof, such as by running Wireshark to capture the passwords as they are sent on the wire.

The second step is to contact the company, such as by sending e-mail to "secure@example.com". The email addresses "secure@" and "security@" are the email boxes companies set up if they are concerned by such discoveries.

Save the responses you get from the company.

When it becomes obvious that the company isn't going to fix it, then post a message to the "full-disclosure" mailing list. Succinctly describe the problem, show the proof, and show the response.

Read email postings to the full-disclosure list in order to see how other people have done this.

  • 2
    "The first step is to find proof, such as by running Wireshark to capture the passwords as they are sent on the wire." — that won't prove anything. To sign up and log in, you obviously have to send your plaintext password to their servers. How else could the server process the password and authenticate you? The real problem is passwords being stored as plaintext in a database. – slhck Apr 13 '15 at 12:08
  • also, it's likely the site runs on https, so you'd need to MITM the connection to sniff and capture the login credentials – sox May 24 at 9:45
  1. Don't use a system you can prove is insecure if you need it to be secure.
  2. Contact the company/owner responsible for developing the system and share your proof of its insecurity.
  3. If you get an unfavourable response from the company/owner that amounts to them being unwilling to correct the system to be secure to your satisfaction, move to another system.

What are best practices in dealing with that system :

Don't use that system with sensitive information. Consider what would the problems for you if there is some data leakage, or if someone begins to use the system with your login. If it's a no-go situation, stop using the system.

[best practices in dealing] and the owners of that system :

Register your insatisfaction using email and any other means of contact: customer support, phone call, contact emails, foruns, blogs, wikis...

while minimizing risk to yourself via the use of the system :

if you consider that you will use that system anyway, then don't use the same password for that system and any other system. If you can not use your email as a login, even better.

or reporting of the related issues?

the same other answers have told you: register all your complain, stop using it.


Changing the password has been suggested already. Changing it to "do not store passwords in plain text, you lamers!" and then e-mailing them asking to remove your account and delete all personal data might help your message being heard.

Apart from that, passwords in plain text are not that much of an issue since even hashed password databases can be bruteforce-attacked in a reasonable amount of time nowdays, especially if the hashed data does not contain any salt.


What's the difference between storing and emailing a plaintext password and emailing a unique link to a page to reset your password when you forget it?

I guess if you use the same password on a different site it could mean a hacker can get into your other accounts. Or if they break the whole site and get hold of the database, and even then, what's to stop them getting the salts used in encrypting your passwords.

Sending the passwords in plain text (or containing a unique link to a reset form) over email makes no difference to their ability to get into the site if the hacker has access to your e-mail. You're basically screwed unless the site has a policy of only snail mailing you passwords when you forget them, or requires an authentication token such as the chip-and-pin devices banks now require.

  • 2
    A password reset link can be configured as single-use. If the legitimate user clicks it first, an attacker won't be able to use it. The link can also expire, in case the user doesn't receive the message. – Jonathan Feb 6 '12 at 18:32
  • True, but if someone is targeting you it makes no difference. If they're snooping your email traffic or have access to your mail box in any other way (which is the premise here given we're talking about sending mail in plain text), they just have to press "I've forgotten my login" and they'll be in before you even know you've got the mail. It doesn't matter that it times out or is single use, they wont press it until they are already snooping your traffic and they'll follow the link straight away. The only secure thing to do would be to lock the account and snailmail a link/unlock code. – fwgx Feb 8 '12 at 8:34
  • For completeness, here's this question on its own, with a good answer: security.stackexchange.com/questions/13026/… – Aseem Kishore May 30 '12 at 14:29

There is nothing wrong with storing plaintext passwords. In fact, in some ways it is the best solution.

[not] storing passwords in plaintext limits the security of communications.

it is more secure to send passwords encrypted over the network, and store them in plaintext on the database, than sending the passwords in plaintext over the network and store them encrypted on the database.

In other words, the server needs to know the user password to support the most secure authentication mechanisms.

source: ejabberd Book, chapter Store passwords in plaintext in the database for security (link)

  • 5
    If this is specific to a product, the answer should say so. Otherwise, this is a dangerous and misleading answer to put here. Storing it as a plaintext is never more secure than storing it hashed. Working around a limitation of a product is not being more secure in general. – Chris Murray Dec 8 '14 at 17:22
  • 3
    Further, the person who wrote that "book" (rather, an FAQ on a website) doesn't seem to understand security, or the importance of hashing passwords. No competent programmer (with an understanding of security) would advocate either plaintext or encrypted storage of passwords. – Chris Murray Dec 8 '14 at 17:26
  • 1
    To properly understand hashing, go read Thomas Pornin's excellent answer here – Chris Murray Dec 9 '14 at 12:22
  • 1
    And any lock can be picked, given enough skill and time. Should we not bother locking our doors? – Chris Murray Dec 9 '14 at 13:57
  • 4
    You do not understand hashing if you think it's "essentially obfuscation". You cannot reverse a hashing function. Yes, it is worth focusing your time on the most critical vulnerability in your app, but that doesn't mean that you can ignore all other failings. Storing a password in plain text is never better than storing it hashed, and you haven't given any examples to the contrary. – Chris Murray Dec 9 '14 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.