Passwords are stored encrypted. Sessions expire after 30 days.