They could hash the full password and just store the two characters in clear text, no?