password change policy / encrypted or plain text?

Hi all, sorry if there is a thread for this, but didn't see one.

When using the Local Accounts payload in the jss policies, is a password change sent with the password encrypted or plain text?

Could the password be sniffed out?

Thanks
David