It's a horrible practice that reduces the entropy of your password a huge amount, but it's possible to generate these things without storing them in plain text.

It's a horrible practice that reduces the entropy of your password a huge amount, but it's possible to generate these things without storing them in plain text. Like if you know you're going to ask for 6 of the 9 characters every time, you'd just pre-hash whatever subset of 6-character passwords you plan on using. Of course, this turns a 9-character password into at most 84 six-character passwords, so assuming they allow all printable ASCII characters, you go from 1e18 possible combinations to 84 passwords of 1e12 possible combinations - of which you have to crack two, with the second one being 100000x easier than the first, so overall the password is ~1,000,000 easier to crack from the hash. I imagine in most cases it's actually a signficantly greater reduction in security than that, so it might as well be plain text. I think the idea is that they are worried that their customers will enter in their real, full password on something with a keylogger.