"What can I do so the characters can't be seen when a user types a
password?" is a frequent question.  [Tk] applications have a complete
and simple answer:  use [entry]'s -show option. For a usage example, see [A little login dialog].

A [pure-Tcl] solution is slightly subtler.  In a Unix context, the
formula is
        exec stty -echo / echo
[[elaborate, including [signal] hygiene ...--which [Expect]
handles by itself]]