Youtube doesn't know your password. Neither does Facebook, or Twitter, or any decent web service, literally.
Your password is not stored in their database. It's safer that way.
A hacker or a rogue employee can't find out what your password is.
So, how do they know that you've typed the right password in when you go back to log in?
Well, there are certain types of maths operations that are really easy to do one way, but really difficult to reverse.
Multiplying two prime numbers together is relatively easy: 17×11 is 187.
There's a shortcut I used there: to multiply by 11, you times by 10 and then add the original number.
Now, because these two were prime, these are the only two numbers you can multiple together to get 187.
So let's ask the question the other way:
What two prime numbers multiplied together get you similar, semi-prime number? Let's pick 299.
Well OK, it can't be 2× something, because it doesn't end in an even number.
It can't be 3× something, because the digits don't sum to a multiple of 3.
It can't be 5× something, because it doesn't end in 5 or 0.
Can it be 7? Well, I don't know,
I have to work that out the long way and there are so many other numbers it could be.
There are a few shortcuts that computers and good mathematicians can use to make the operation a bit
faster but, in summary, particularity for huge numbers, there is no efficient way to reverse that operation.
It is maths that is easy to do one way, and difficult to reverse.
Now to you, your password is a string of letters, or symbols, or numbers but to a computer
it is the same as everything else - a string of binary digits - ones and zeros,
and you can do maths on those ones and zeros, you can do those one way operations.
Not necessarily anything to do with prime numbers, although there sometimes is.
That process is called hashing, and there's something called salting that makes it more complicated still,
but basically what you have at the end: you type in your password when you register -- "abc" --
you put it through a process, what you get is a random string of characters.
That's what they keep in their database, and when you type your password in again to log in
they put it through the same mathematical one way operation.
If the hash that comes out matches what they have in their database then they know what you entered
was right, even though they don't know anymore what you actually typed in.
And if they've done it right, you can't reverse that hash back to your password without centuries
of computer time or billions of dollars.
That's why Google, Facebook, Yahoo, everyone, they don't email your password when you say
you've forgotten it, they ask you to set a new one. They can't email you. They don't know it.
And for that reason, if you ever find a company that does email you your password when you say
that you've forgotten it, well, run, because they have no idea about security.
If that was interesting, I've done a couple of longer videos over at Computerphile
about hashing and password security and if it wasn't, well –
The stunts you are about to see were performed by trained drivers on a closed course.
Do not try this at home.
[Translating these subtitles? Add your name here if you'd like credit!]