"What can I do so the characters can't be seen when a user types a password?" is a frequent question. Tk applications have a complete and simple answer: use entry's -show option. For a usage example, see A little login dialog.
A pure-Tcl solution is slightly subtler. In a Unix context, the formula is
exec stty -echo / echo
[elaborate, including signal hygiene ...--which Expect handles by itself]