A bit of context:
I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a reinitialization link or a temporary password but my real password in plain text. After contacting the webpage owner to ask him if he was stocking passwords without encrypting them, he answered that there was a number of ways to keeps password encrypted on their servers while still being able to send the password back. In my understanding a good encryption cannot be reversed by the server and a password cannot be “safe” if there is a request allowing it to be decrypted.
Is there a way to do that? If there is a way to do that, what is it? What are its strengths and drawbacks?