I think retrieving a password is more than a marginal convenience for some audiences. And again, off all the things in a database you don't want the world to se

I think retrieving a password is more than a marginal convenience for some audiences. And again, off all the things in a database you don't want the world to see or manipulate, a user's password is pretty low down on the list. No matter what, as the operator of a website, you'll need to make your own decisions about the various tradeoffs involved. edit: If, as you asserted, a user forgetting a password means that they're not attached to it, that's all the more reason to keep it around, since they aren't using it elsewhere. I don't think it's unreasonable to assume that people won't break in and see the database (short of you screwing something more important up).