Needs to have the actual password obscured, e.g. with asterisks.

In fact, also the length should be obscured, show nothing, as is the way in Unix password prompts!