Hybris Commerce's default encoding strategy is plain text. Obviously, this encoding strategy is not safe, and must be changed before going live with your Hybris implementation. To verify the encoding strategy has been changed from plain text, you should run the following FlexibleSearch query in HAC or backoffice:
select {uid},{password},{encodedPassword}, {passwordEncoding} from {user} where {passwordEncoding} != 'md5' or {passwordEncoding} != 'sha256' or {passwordEncoding} != 'sha512' or {passwordEncoding} != 'pbkdf2'
