That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one. old: year-p

That's a serious security risk if a website knows your older password and you're newer password is just one character different than the older one. old: year-password-counter (23supassword1) new: year-password-counter++ (23supassword2) If website tells you that you cannot use your new password, then it screams that they're somewhat storing/accessing the old password. If they're storing just the hash, there's NO way it could have been detected. (Unless they take your new password and then check from a-z0-9 last characters, convert to its hash and then compare with old password hash) but in my entire IT Security career, I have never seen it doing anywhere.