Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code!

And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password:

  lastUserId: "xxxxxxxxx"
  storedUserIds: ["xxxxxxxxx"]
  Uxxxxxxxxx.StationSortOrderAlpha: false
  Uxxxxxxxxx.isAnonymous: false
  Uxxxxxxxxx.Username: "xxx@xxx.com"
  Uxxxxxxxxx.Password: "myCleartextPassword"
  hasLoggedIn: true

  (xxxxxxxxx) is the numeric Pandora user ID.

I will publish an tool for decryption as a proof-of-concept, in the next hour.

What were Pandora's developers thinking? This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage.