Any username/password will pass through the server, so technically they can see what you're sending.
Depending on the nature of the proxy and the site in question, another person going to the same URL might even automatically end up being logged in as you as well (if they're determining sessions based on IP address rather than cookies or something, since to the end-site the originating IP address will be the proxy, not your computer)
But even if the website in question doesn't mix up the sessions, there's still the issue that the proxy can see (and save) your username/password info should htey choose to do so. After all, it's traversing their server in plain text.
You're only (mostly) safe if the site uses HTTPS instead of HTTP, because the HTTPS link is encrypted end-to-end, and the proxy can't read the contents such as username/password info.
Depending on the nature of the proxy and the site in question, another person going to the same URL might even automatically end up being logged in as you as well (if they're determining sessions based on IP address rather than cookies or something, since to the end-site the originating IP address will be the proxy, not your computer)
But even if the website in question doesn't mix up the sessions, there's still the issue that the proxy can see (and save) your username/password info should htey choose to do so. After all, it's traversing their server in plain text.
You're only (mostly) safe if the site uses HTTPS instead of HTTP, because the HTTPS link is encrypted end-to-end, and the proxy can't read the contents such as username/password info.