I don’t have enough desire to check, but I’d assume they are encrypted AND salted so it’s not as easy as the top comment makes out.

If an instance was hacked, the hackers would get a hash and a salt. They’d still have to figure out what plaintext password + salt = hash.

use unique passwords with every account, everywhere.

This is the way.