Password change dialogs generally have entries for: Previous Password: New Password: Confirm New Password: They don't need to store the plaintext

Password change dialogs generally have entries for: Previous Password: New Password: Confirm New Password: They don't need to store the plaintext password, as you're giving the old password plaintext to them in the same dialog. Now, if such rules were against "any of your last 4 passwords" instead of just the last password, then that's much more difficult to do. (Obviously nobody is going to cooperate with a form requiring the person to submit their last 4 passwords as part of the password change dialog.)