Hashed, you store them hashed (and salted). A breach should never reveal passwords.