[kh99]

For a little added security, there's javascript on that page that hashes the 'password' and 'confirm' fields using md5, and sends the hash values in the password_md5 and passwordconfirm_md5 fields. It clears the password and passwordconfirm fields (because of course there's no point if it leaves the plain text values there).

If you have some reason to access the plain text password, you can turn off the clearing of the plain text fields by defining DISABLE_PASSWORD_CLEARING (probably the config.php is a good place). It's obviously a little less secure that way, but I don't believe it's a major security risk.