Passwords are stored in hfs.ini, encoded in some form, then stored as plaintext in memory when HFS loads. You can access them directly through the HFS interface.
To log on, HFS uses only basic HTTP authentication (built into browsers) that only requires the username and password be sent encoded in the header of every request.