`<input type='password'`, just like TFA was talking about?