Can Traffic spy see the username and password of client send to broker when broker don't use TLS ?
Yes, without TLS the CONNECT packet is sent in the clear so all of it's content can be seen.
A full breakdown of how to decode the CONNECT packet can be found here
