Let's say I typed my password into the username textbox of a frequently-visited website (https of course) and hit enter before I noticed what I was doing.

Is my password now sitting in plaintext in a log file somewhere? How could my mistake be exploited by a crafty miscreant? Help me understand the factual security implications regardless of the likelihood of it actually happening.

  • 4
    I don't understand why this question is flagged as "opinion-based". It clearly asks "What are the security implications" which can be (and is, given at least the accepted answer) backed-up by facts.
    – Calimo
    Feb 14, 2014 at 9:18
  • This is on-topic on security.stackexchange.com
    – kinokijuf
    Feb 14, 2014 at 9:35
  • @kinokijuf: Certainly I considered that first, however Information Security Stack Exchange is a question and answer site for Information security professionals. I'm not one, and I don't think we need one to answer this question. I made a mistake that any user could make, and I think the answers are interesting to users, not security professionals. However I could certainly be wrong.
    – agentnega
    Feb 14, 2014 at 9:57
  • You're right, it should have been closed as "too broad"
    – random
    Feb 14, 2014 at 17:07

2 Answers 2


It depends on configuration of authentication system of the site. If it was setup to log any attempts - than yes, it is now in the log (text file or database) in plain text. It could look like that:

12-Feb-2014 12:00:00 AM: Unsuccessful login attempt user (YOUR_PASSWORD_HERE) from (YOUR_IP_HERE);

or similar.

It is still true that password will not be accessible for regular users. Only for those who have access to log files.

What consequences it implies?

  • If server would be compromised - than hacker theoretically will have your plain text password.
  • Site's admin could routinely go thru the log files and accidentally find your password. He can than find what IP address this record came from and thus he can theoretically find what is your username and e-mail (because he has access to the database).

So, if you have same email/username/password on other resources - than change it immediately. Because there are chances that your password will be found. Logs can remain on servers for years.

  • 8
    There may be a local record of your attempt as well. Many (most?) browsers have an Autofill feature that's enabled by default and saves certain form entries - username, email address, phone#, etc. - for your convenience. If you open the login page again, click on the username field and press the down arrow key you may see your password listed along with username(s). You can delete it from the list, however, to be absolutely safe it would be best to change your password as suggested above.
    – gm2
    Feb 13, 2014 at 18:00
  • The site admin can know your username, e-mail and password no matter what. Trying to hide that from the site admin doesn't make sense. Jul 14, 2023 at 12:18
  • @12431234123412341234123, sure. A malevolent admin can get your password no matter what. The point of my answer is that submitting password in the username field could result in the exposure of the cleartext password in places where it can be seen by other people, including well intentioned admins or malicious actors who managed to get access to logs or backups where logs are stored, etc. Anyway, chances of other people seeing it increase.
    – VL-80
    Jul 15, 2023 at 3:27
  • My comment was only to the second point "Site's admin could routinely go thru the log files and accidentally find your password..." Of course, a password in the username field is a risk even for sites with a well intended admins (but less educated since they log logging attempts with unknown usernames). Jul 17, 2023 at 7:50

Just as you said, webaplications tend to keep logs of unsucessful logins attempts. If someone would be looking through the logs, he can connect this particular login attempt with your another, successful attempt (i.e. via IP adress).

Though I do not think this is likely to happen, you can always change it be sure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .