I'm not an expert in this, and I did look around after reading your comment. Looks like the password is usually sent as-is, then hashed server side, and matched against hashes in the database. So, the hashes are what's stored in their database. So, ideally, the server shouldn't know your password. Also, it can be hashed from client side too, but that becomes redundant since everything is tls encrypted anyway.