they are sent to our server and the password is encrypted at rest in our database using the bcrypt hash algorithm.