Hashes or whatever. The point is they have the ability to tell if I typed in an old password, so they must store some form of it somewhere.