A plain-text password is a secret stored or exposed in readable form, without encryption or hashing. Because the value is directly visible, anyone who finds the file, log, database field, or leak can immediately use it. That makes plain-text passwords far riskier than properly protected credentials, which should be hashed for storage and only decrypted temporarily when absolutely necessary.
In cyber security, plain-text passwords are dangerous because they speed up account takeover, lateral movement, and reuse attacks. Attackers often find them in export files, configuration backups, spreadsheets, email archives, scripts, or legacy databases. Defenders should search for them during incident response, rotate any exposed credentials, and remove secrets from documents and logs. The best prevention is to store passwords with strong one-way hashing, use a password manager or secrets vault for operational access, and limit where credentials appear in the first place.