[ConcernedCitizen]

Thank you so much for the detailed answer.  I actually learned something new.  I thought by law they couldn't keep copies of your password anywhere, but I guess you're right at some level it muss be accessible.  @Oni you know my pass? 

I'm not entirely sure on that password thing tho
Password are hashed and salted, and the result is then saved in the DB, so the only time they have your password (HOPEFULLY) is when you input it in the login form, once it arrives on the server it'll undergo the same procedure as above and then the 2 encrypted passwords are compared, if they match you're in (which MAY lead to collisions, where 2 completely different passwords generate the same hash)
There's no way to revert an hash back to its plain text version.. well, there are rainbow tables (basically huge lists of "this word + this encryption = this hash", so you basically reverse-search on it starting from the hash), but if you add salt then it's way more safe
So no, I doubt the admin here knows your password, if he did his job right

Of course, any website could log your password in plain text / the developer could dump your login info to a plain text file / they could use an unsafe encryption / etc, but that's not how it should be in the norm

Just to reiterate my point, the passwords are stored in encrypted format, so they are salted with a 1:1 or more length of the resulting hash and then stored by the database, not allowing anybody on the site to read your clear text passwords even if the database is leaked. That said, there are some programs criminals will use that systematically check hashes on public database leaks to find one that is derived from a weak password. This allows them to gain initial access to accounts. in the event of a security breach, but any compromised passwords are unintelligible to the bad actor. As a result, the theft of this information is considerably more difficult. Also, thanks for mentioning collisions, because they are possible. It results from a password being hashed and returning the same value as another.

Salting passwords is much more secure and you will usually see bcrypt or SHA being used for the process. bcrypt is the same algorithm used to hash your server passwords on your Linux machines. Salting and having a collision is very unlikely but it's irrelevant when you consider the use for hashing is mainly to prove the authenticity of something. Digests for verification are not as important as password storage. Files with two different hashes could be malicious but it's highly unlikely considering again the difficulty of the method. You would need to do expensive computational attacks and if the algorithm is strong it will take more effort than it's worth.

sinister.li no doubt uses bcrypt for hashing:

Code:

$hash = password_hash($password, PASSWORD_BCRYPT);

This method can be made cryptographically stronger using as strong hashing algorithm on the result again, if necessary. But most forums use SHA1 or bcrypt. Also note that salting will not protect you against dictionary attacks as they are performed on the password level as opposed to the hashed level. You should also not be relying entirely on password + salt to keep you secure. Use MFA where possible and even with the correct password, account takeovers are unlikely.