A capability allows a narrow set of operations on one project for a short time and is checked on every use, while a password would open your whole hosting account outside SyncNow's checks and records.
The agent asks SyncNow to read or write a file or query a database, and the server performs the operation with the credential from its vault. When a file holds a secret SyncNow recognizes, such as a password already in its vault or the database password in wp-config.php or .env, the agent reads it with the value replaced by a placeholder starting with __SYNCNOW_SECRET_, and when the agent writes the file back the server puts the real value in. A copy saved with download_path is redacted the same way and says so, so its local hash is not expected to match the file on the server.
A placeholder works only in the file it came from: writing it into another file is refused, so it cannot be used to copy the secret elsewhere. Results of database queries are not redacted, so an agent allowed to read the database sees what the database contains.