On browser side implementations or extensions, they can see the input into the form field. As for plain text, generally sites will send the plaintext password over HTTPS when logging in, and it's the server side which hashes/salts, and compares to the value in the DB. Sites can reject or inform users to bad passwords this way, generally when changing the password. Cloudflare does offer a product to do this for sites to add warnings to the user if the credentials were found in a breach. More information on that here: https://blog.cloudflare.com/privacy-preserving-compromised-credential-checking/