Or they want to disallow reusing previous passwords, without leaking them to the client. As an aside, I have always wondered how it is possible to disallow reu

Or they want to disallow reusing previous passwords, without leaking them to the client. As an aside, I have always wondered how it is possible to disallow reusing previous passwords if the password is only saved on the server as a salted hash, which is recommended I believe. Is it possible?