When using input fields, any text that is entered will be readable. Since there is no specific password field to be used, the input field is the only option.
To mask a password that has to entered in an input object, there are two options. The least complicated is to include a font that consists only of the star character and use this font for password fields. It may be possible to find a freeware font for this purpose – if not, consult a font vendor such as Adobe.
The other option is to construct a script which is run on every keypress inside a password field. The script should recieve any character that is typed and save it in a hidden variable which can then be checked against a saved password. For every time the script is run it should replace all characters entered in the password field with a star. The flaw in this method is that passwords must be entered correctly in one stretch as the backspace button will not work.