Can traffic spy see username and password of MQTT client

Question

Can Traffic spy see the username and password of client send to broker when broker don't use TLS ?

Answer 1

Yes, without TLS the CONNECT packet is sent in the clear so all of it's content can be seen.

A full breakdown of how to decode the CONNECT packet can be found here