Your password is stored hashed with scrypt and is never shown. The session is kept in a secure cookie.