Other people who are simply browsing the same URL can't see it.
However, the password is "plain" in the script and in the network packets.