Ideally websites only store the hash, but you have no way of verifying which websites are actually doing that (and if they are doing it right).