A plain text password is stored or transmitted in readable form rather than protected by encryption or a secure password-hashing method. Anyone who obtains the underlying file, database, or network traffic may be able to use the password directly.
In cyber attacks, stolen plain text credentials can let intruders access accounts and systems, potentially enabling further data theft or disruption. Defenders should store passwords using a strong, salted hash, protect credentials in transit, restrict access to secret stores, and replace any passwords that may have been exposed. If an organization learns that credentials were stored in plain text, it should assess which accounts are affected and review for unauthorized access.