A method and apparatus are disclosed that enable a user who forgets one of his two passwords to securely recover the forgotten password. After a user logs in using one of his two passwords, the illustrative embodiment reveals the other password to the user. The passwords are stored in a persistent table in both hashed and encrypted forms, but not in their original forms. The illustrative embodiment is advantageous over the prior art, where forgotten passwords are reset to a default value, in two ways. First, it avoids the inconvenience of a user having to log in using the default password, think up a new string that would make a good password, and change the password from the default to the new string. Second, it avoids the use of default-value passwords that might compromise security.