Not true, even Windows Defender is capable of extracting "the password is 1234" from context like emails or webpages.