I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security features like this?
A browser should do it. If the login page is HTTP rather than HTTPS, then you already have a problem as even if the credentials are supposed to be passed over HTTPS, an active attacker could modify the login page to change the action, or perform other additional malicious actions.
To determine if even in the designed state credentials are being passed in the clear, just view the source of the login page in the browser. If the login form action is HTTP://, or if the login page is HTTP and the action is relative or schemeless, (relative looks like
action="/process-login" and schemeless looks like
action="//insecuresite.com/process-login") then credentials are indeed being passed in the clear.
You can also use the "Network" tab (or equivalent) in your chosen browser's developer tools, often accessed via F12 to examine the actual request to determine if it is HTTP or HTTPS.