I was able to sniff out my session id, however it can't be set by javascript since it's httponly. But what about the password? I haven't found it in plain text,

I was able to sniff out my session id, however it can't be set by javascript since it's httponly. But what about the password? I haven't found it in plain text, so I guess it could be hashed? I'm a developer, but this is my first time dabbling with this kind of stuff...