A plaintext credential is a password or other authentication secret stored or transmitted in readable form rather than protected by encryption or a secure hashing method. Anyone who can access the file, system, or traffic may be able to read and use it.
Exposed plaintext passwords can enable unauthorized access, especially when they belong to privileged accounts or are reused across services. In real incidents, they may appear in configuration files, backups, scripts, email archives, or database connection settings. Defenders should restrict access to stored secrets, use a secrets manager, replace exposed credentials promptly, and use unique passwords with multifactor authentication where possible. A reported leak may raise this risk, but does not by itself confirm that credentials are genuine or were used.