Passwords should never be echoed back to the browser. (There are still a few cases of this in OJS 2.4.x but they're filed for destruction.)