They can see all passwords and ALL data. The SSL connection or httpS encryption is stripped away by Cloudflare
[SP]
Jan 10, 2024