If you have a memory cartridge (MMC) inserted, the password might be stored there as well.
Passwords are case-sensitive, up to 8 characters long, and stored in the system block of the PLC. Crucially, the password is not stored in plaintext but as a hashed value. However, the S7-200 uses a relatively weak hashing algorithm compared to modern standards, which is why third-party unlock tools exist. Siemens S7-200 Password Unlock