Ultimately the answer is yes, they can see what you are doing on their WiFi. Whether they can read passwords or not depends on the websites themselves. Sites that are secure will encrypt passwords so external devices can't read them, but if a website deal passwords in plaintext then it's anybodies game.