Fix: hide password characters