They can see that you connected to the vpn and how much data went back and forth. It will be encrypted so they can't tell what it is. They also can't tell what the destination is after the vpn site. However, the vpn site can see all that stuff. Which do you trust more? Your isp, or the vpn site?

As far as passwords, as long as the website address uses the HTTPS protocol, your isp can't see them. That communication is encrypted also. But the isp can tell which site you are connected to in this case.