The plugin works by overriding the confirm_password? method of the User class.
It first calls the original password check and doesn’t do anything when the password is accepted by the core Discourse logic.
If that’s not the case, it checks whether the user has a import_pass custom field and if so, it uses all available algorithms to check the entered password against the import_pass hash.
If it finds a match, it saves the entered password as the password for the user and allows the user to log in.