Drupal 8 password retention I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal also store a user's previously used passwords so that they can't reuse them again? If it does, does that list have a hard limit to it (i.e. does it only store the last twenty used passwords before recycling the list)?

I am only interested in the out of the box experience with Drupal 8. I know there are modules that you can use to add extra functionality/security to user passwords but that isn't part of this question.

Thanks.
Out of the box, Drupal only stores the salted hash for the current password. No previous passwords are stored without the help of a contrib module such as Password Policy.