Actually, you don't have to keep unhashed passwords around. You can just return the wrong password in a hidden field. When the form is posted, if the hidden fie

Actually, you don't have to keep unhashed passwords around. You can just return the wrong password in a hidden field. When the form is posted, if the hidden field is set, you can do some analysis. This might involve storing some 'intermediate state' of the Levenshtein algorithm, for example, to find the shortest edit distance. You would only store that information anonymously, without storing the passwords. (I'm not saying they do this, that's just of the top of my head.) Edit: Or just keep the (wrong, correct) pairs for users where correct is in the top 20 most common passwords.