No matter if you're on encrypted WiFi, unencrypted WiFi, 3G, etc. if the site's title has a lock next to it, you can be sure that your password cannot be captured by anyone snooping the traffic. The lock means that you and the website are using a secure, encrypted connection.
Keep in mind however, that if after you log into the site and the lock no longer appears, you're vulnerable to anyone running a copy of Firefox with Firesheep installed. They won't get your password but will essentially be able to be logged in as you.
For sites that do not keep a secure connection (a lock in the title bar) after logging in you should avoid using them on unencrypted WiFi. As far as I know, Gmail uses a secure connection all of the time.
When you enter your password for App Store purchases, even though there isn't any real indication, your phone is establishing a secure connection between it and Apple. It's very safe.