On my user profiles there is a second password field, this is used for a single sign on to another system. I would have thought that anything with the password type field would not be stored as plain text in the database, but that appears to be the case.