Of course a keyboard app can capture your passwords as you type them, along with everything else you type: naughty text messages, credit card numbers, web searches, everything. You couldn't have a mechanism to stop it, because in a sense, that's what it's for.
It can only send this or any other information across the internet if it has the appropriate permission, "full network access." Almost all apps use this permission, though, and a keyboard might want it in order to download new language files, or to show ads if it uses that revenue model. SwiftKey, for example, has a "cloud sync" service to let all your devices share the same training data. This can only work by transmitting words you've typed, and statistical data about text you type, across the internet to their servers.
Android warns you that this is the case every time you enable a third-party keyboard in the Language & input settings. Nexus devices show a dialog with the message:
This input method may be able to collect all the text that you type, including personal data like passwords and credit card numbers. It comes from the app Highway. Use this input method?
but as I mention in another question, manufacturers can replace the message (perhaps with one that's not entirely true) or disable it completely.