Before I retired in '99, I ran the helpdesk for a large company, which included managing network passwords. With over 2000 people using computers at just our location, it seems useless to say there were a lot of password resets. Our network passwords were encrypted. We designed and installed a program specific to our location which also required a logon ID and password. Almost 100% of the employees made their passwords match, as they expired monthly on the same date. One day a guy called in and of course he had forgotten his password. I looked up the password on our local program (it was not encrypted, but we kept them in a secure database) and told him. Once he tried it and found it worked, he told me that he was going to change it, being as I had seen it. Of course, I agreed with him.