I have some domains/websites as well as emails with Bluehost.  Every time I need support, they need the last 4 characters of my main password for the account.  They cannot tell me how they store the password, so  I am intrigued in how they could safely store my password(s) and still see the last 4 characters. Do they see the full password in plain text?
There's several possibilities.


They could be storing the full password in plaintext, and only
displaying the last 4 characters to the support person.
They could be hashing the password twice.  Once hashing the full password,
and again with just the last 4.  Then the support person types in
the last 4 to see if it matches the hashed value.  The problem with
this is that it makes it easier to brute force the full password
since the last 4 characters are in a separate hash, reducing entropy.
They could be hashing the full password, and storing the last 4 in
plaintext.  Obviously this makes it much easier to brute force the
password if an attacker gaining access to the password database knows     the last 4 digits.
Something else where the last 4 characters are stored in some way
that's discover able, such as encryption that Mike Scott mentions below.  If the secret to unlock the 4 characters can be discovered, this is as bad as plaintext.


All scenarios are very bad, and greatly reduce the security of the system.   It's not possible to know which scenario they're using, but each of them shows a lack of consideration for security breaches.  I'd advise caution if this is a site where you care about your account being breached.  
