As you see in this picture, user passwords are encoded.
Client send encoded passwords to the cipsoft tibiame server and even if my bot could send user passwords (it doesn't) to my pc, I couldn't do anything with received passwords.
By the way, it's v2.18 jtibiame server.
My jtibiame server can check if encoded passwords match the ones in database or not.
So, feel safe. You're in good hands and no one is spying you or seeing your character data.