Windows XP saves user passwords as an encrypted numerical 'hash' - taking a password of say 'password' and turning it into something like "HT5E-23AE-8F98-NAQ9-83D4-9R89-MU4K." This hash value is then stored in the SAM (Security Accounts Manager) file, found in the C:\windows\system32\config directory.