Admin credentials are validated on the server. Passwords are not stored or exposed on the frontend.