This is incorrect, passwords should be hashed, not encrypted. Hashing is only one way (unless you use a terrible hashing algorithm or your attackers have access to a quantum computer), these hashes are also often salted, which means adding extra data to the hash to protect against some attacks