Plaintext password
A plaintext password is a password stored or exposed in readable form, with no hashing or encryption between the file and the person reading it. In breach data it is the most dangerous password format, because an attacker can try it immediately without any cracking step.
Current as of · Editorial policy
How it works
A well-built service never stores the password itself. OWASP states that passwords should never be stored in plain text and recommends slow, one-way hashing algorithms such as Argon2id, bcrypt or PBKDF2. MITRE's CWE-256 rates the likelihood of exploiting plaintext password storage as high, and warns that an encoding such as base 64 does not protect a password, because the encoding can be detected and decoded easily.
Plaintext also appears by another route. Information-stealing malware can capture credentials as they are entered into websites, as Troy Hunt describes, so the password it records is plaintext even when the site stored it properly.
How it shows up in executive exposure
When a breach exposes a plaintext password next to an email address, nothing stands between that record and an attacker. The password can be tried on the original service and, if reused, on others. This is why a plaintext hit weighs more than a hash hit. The stealer logs Troy Hunt analyzed held website URLs with the email addresses and passwords entered into them, and were published on a Telegram channel.
In WebThreat's CEM, a breach record that exposes a password is typically rated critical and moves that leader up the list of what to fix first, as the methodology explains. EDG3 watches the Telegram channels and dark web forums where plaintext credentials are traded.
How to reduce the risk
- Change a password as soon as it is seen in plaintext, and every other account that shares it.
- Use a password manager to give each account a unique password.
- Enable multi-factor authentication.
- If you run a service, hash passwords with a recommended algorithm and a unique salt, and never log or store them readable.
How it differs from related terms
A hashed password is stored as a one-way transformation, so an attacker must crack it first. A plaintext password needs no such step. A credential pair is the combination of username and password, in either form. The article on what to do when an executive's password is in a breach covers the practical steps.
Frequently asked questions
Why would a breach contain plaintext passwords?
Either the service stored them unprotected, or malware on the user device captured them as they were typed. Both produce readable passwords.
Is a hashed password safe to ignore?
No. Weak hashes can be cracked, and a cracked hash becomes a plaintext password. Treat any exposed password as compromised.
Sources
- Password Storage Cheat Sheet, OWASP, accessed
- CWE-256: Plaintext Storage of a Password, MITRE, accessed
- Processing 23 Billion Rows of ALIEN TXTBASE Stealer Logs, Troy Hunt, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.