I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal also store a user's previously used passwords so that they can't reuse them again? If it does, does that list have a hard limit to it (i.e. does it only store the last twenty used passwords before recycling the list)?
I am only interested in the out of the box experience with Drupal 8. I know there are modules that you can use to add extra functionality/security to user passwords but that isn't part of this question.