I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password is not being stored only as a hash?
No, you cannot conclude that.
The password can be hashed on the server-side only, which implies that the password is sent in plain text to the server and stored in a variable. Then, nothing stops the Web application from displaying the sent password to the user, in the case where the very same script that has received the password is giving you the feedback about the password change.
On the other hand, if a whole other module gives you the password in plain text (perhaps a password recovery function), then you could conclude that it is not hashed.
Edit: To avoid any confusion, in this case "plain text" does not refer to SSL in any way, it simply suggests that the password is not sent pre-hashed to the server.
You can't conclude the password was stored in plain text if it is redisplayed soon after you changed it. On the other hand if it is displayed after a while (days for instance) it may be a good hint that the password is indeed not hashed (it is stored in plain text or encrypted).
Anyhow, redisplaying a password is clearly not a best practice because it may compromise much more than the web site that is actually being visited.
As others have mentioned this doesn't necessarily mean the password is stored in plain text but is a bad sign and bad practice.
Some ways to determine if your password is stored in plain text are:
- Using the password recovery to see if it's emailed to you (this indicates plain text or 2 way encryption at the most).
- Check the password requirements, if there's a low max length (for example 15 - 20 chars) that's a good indicator that it's stored in plain text.
In general you should be using a unique password for every site, especially if you see any indicators that it's not stored properly.
No it doesn't. The password is probably sent to the page where it's displayed to you and at the same time it's stored. We cant say if it's stored hashed or not but displaying the password to you does not mean it's not hashed. Like the other answers, I do agree that it's a terrible idea to show the password on the next page in plain text. It's bad anyhow to show it. Not the best example but what if you changed your password when you're (in your case) with a student next to you. You tell him to turn around while you type in your password. You say you typed in your password to him, he turns around, the next page is loading and the person can just see your password. My friend was in the same situation and I saw his password.
Just ask the admin.
Really, my experience is that they'll tell you if they're storing the password in plain text.
To answer your question directly, no based on the information you've provided it's not possible to know if the password is stored (locally or remotely) in plain text beyond that session.