Plain HTTP. This password crosses the network unencrypted. Do not reuse a password you use anywhere else.