PostgreSQL dblink password encrypted or not?
Basically, dblink uses a libpq-style connection info string.
Add sslmode=require to your connection string or a more restrictive setting to disallow unencrypted transfers. More details in the manual here.

I would also advice not to have the password in your SQL statement at all. SQL statements may get logged. Or backups are stored in an insecure location ...
I use the password file .pgpass for dblink connections.