camouflages passwords as user types them