Yes username is stored in database as a planetext but password in hash but do any thing when database get compromised by attackers then they collect a hashed password and username in palnetext . They may unhash a password and username is alreay in a palne text they convert hash to planetext.