You should almost never know a users plaintext password. Outside of a small set of scenarios you're likely doing something very wrong if you need a users plain

You should almost never know a users plaintext password. Outside of a small set of scenarios you're likely doing something very wrong if you need a users plaintext passwords. Passwords should almost always be bcrypt'd.