They shouldn’t store the passwords themselves, but rather one way hashes* of the password. When the user attempts to log in, their supplied password is then hashed and compared with the stored hash for correctness. This is the way passwords have been securely handled for decades.

*For those who don’t know, a one way hash is just what it sounds like. A mathematical operation is preformed on the data resulting in a number. The number can not be used to find the original data, but the same data always produces the same number.

wikipedia: http://en.wikipedia.org/wiki/Cryptographic_hash_function