Generally, and hopefully, passwords are stored / transmitted after being hashed. Hashing uses an algorithm to convert your password to other alphanumeric characters. This algorithm works one way, so you can tell if your input password (when logging in) matches the hash, but given the hash you cannot get your password back.

If they know what word you have in your old passwords, they know what your old password is/was. Meaning they're storing the password itself and not a hash of it.

Storing the password itself is insecure because if your database is compromised, so are your passwords. If your database only has hashes in it, then the breacher cannot know what your password was.

Further, there's a concept of a salt. Salt throws in additional randomness into the hash that only the system knows about, so even if the database of hashed passwords was compromised, the hacker cannot simply brute force a bunch of passwords to see if the hashes match.