Safari stores your passwords in your login and/or iCloud keychains. So they are encrypted on disk, but the master key is kept in memory unless you change the setting to disallow that. (/Applications/Utilities/Keychain Access.app, right-click on login keychain, choose Change Settings for Keychain "login"; I don't know how to change this setting for the iCloud keychain)