Encrypted traffic with vault?

If you are using winrm over http (5985) and ansible-vault for creds…on passing that traffic are the passwords in clear text? Or if you are using Kerberos that encrypts it? I’m guessing ansible-vaults encryption is for that file only.