passwords are hidden on entry