Hash, not encrypt. And "Should", yes. "Did" maybe not so much. Or to weak password/hashing algorithm combination, so it could be brute-forced. But if I remember the 000webhost dump was cleartext.