That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).
Developer: Similar passwords? Or Same passwords. Similar is hard.
M: Similar. Can't let people be lazy with their passwords.
D: Well, if we really have to do it, I guess we could store a bunch of hashed variations of the password, but...
M: Good! Let's do that.
D: ...but that could be a massive amount of space for long passwords.
M: Okay, we'll just enforce short passwords then.
D: ...doesn't that more than negate all the benefit of preventing similar passwords when rotating them?
M: Doesn't matter, the CEO said he wants this. Hop to it!
Developer laments the stupidity of their life
Why not generate a list of similar passwords to the new password, hash them all using the same salt of the previous password and then compare them.
Still, permutations longer hashes don't require substantially more space. Password storage is a completely trivial fraction of total storage -- Compare to a single photo, or a video!
And further still, they don't need to _store_ all the hash variations
https://security.stackexchange.com/questions/53481/does-face...
"Is the same as" can be fine with a hash, but "Is too similar" is definitely a red flag.
Though another way around it is to apply a set of common transformations to your new password, hash it and see if it matches the previous one. I.e. if your current password is "Password123" and you try to set it to "Password1234", the system could truncate the last digit on the new password and see if it matches the current one.
I'm having trouble imagining what scenario client-side hashing would protect against.
If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.
