The passwords aren't being stored, though; a value <i>derived from them</i> is. In a properly designed system, it is computationally infeasible for an attacker to obtain the original password given the derived value.