It really depends on the context of your specific website.
For example, if this is a consumer website, odds are that most of them will only care about their passwords (maybe), financial/health information (depending), and their private information such as pictures (hahaha, yeah right...).
If this is a business application, then the level of security of the entire site is relevant, not just passwords. Likewise, it depends on who your target users are - highly technical / not so technical, etc.
All this context greatly defines what you should be communicating, and what level of assurance is required.
For example, for non-technical consumers, it is sufficient to have some generic, simple comments, such as:
This site is built using state-of-the-art security techniques. Your password is always encrypted, and we will never ever send your pictures to the NSA.
(And, as others have said, you are better off not even having passwords at all, use some standard like OpenId or OAuth.)
For highly technical businesses, you would want to have a full page of technical and procedural details, such as:
We have implemented a full SDL (secure development lifecycle) throughout our development and deployment process.
Our security architecture is ... This gives the benefits of...
We ensure secure coding such as ... by... We perform these and those tests.
Our cryptography includes these algorithms... and ...
We are compliant with whichever industry regulation you need, and certified for...
Our security is verified by this independent 3rd party consultant.
For more details, and to review our policies or to arrange an independent audit, please discuss with the marketing department.
Of course, you don't want to be giving away too much detailed information, it should be more about the process than the passwords themselves... And of course it should go without saying that the reality should actually comply with whatever you write there, whichever context you are dealing with.
As one of the answers alluded to, most users don't care, wouldn't understand whatever you tell them, and would still sign up anyway, even if you say that you DO send user data to the NSA.
This is not for them.
They would be just as happy not having any passwords, just let me pick my username from the list and log me in automatically.
Obviously this is for the small percentage that care - you should be enabling the smart users to do what's right, to give them the information they need, and grant them the education they might ask for.
If you don't, when that goes wrong, the other 98% will suddenly wake up and get angry.
("Sure, I knew that I don't need a password to see my pictures, but I didnt think that anybody else could also see them!!")