If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn’t, then it’s different. There’s no reason or excuse to ever store plaintext passwords.
I’m no expert either but IIRC best practice is to use salting and hashing. basically together with your password is a long string of random characters generated by the site (the salt). the two are combined and put into a a cryptography hashing algorithm to give you a hash. the website only stores the salt and the hash. every time you log in you provide the password for the whole thing again and if the output hash matches the stored one then it knows your password is correct, without ever having to store it in any record.
If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn’t, then it’s different. There’s no reason or excuse to ever store plaintext passwords.
I’m no expert either but IIRC best practice is to use salting and hashing. basically together with your password is a long string of random characters generated by the site (the salt). the two are combined and put into a a cryptography hashing algorithm to give you a hash. the website only stores the salt and the hash. every time you log in you provide the password for the whole thing again and if the output hash matches the stored one then it knows your password is correct, without ever having to store it in any record.