Passwords are stored as a one-way hash. Nobody, including us, can see them.

Repeated wrong attempts are slowed down to stop guessing.

Sign-in uses a secure, http-only cookie. Nothing sensitive goes in links.