Not sure if it will work, but if you press ctrl+shift+c when you are editing an xform, you will get the html for the xform. (see http://labs.episerver.com/en/Blogs/Allan/Dates/112230/3/Customizing-XForms-Appearance---The-Easy-Way/)   If you then edit the html by adding an <INPUT TYPE=password /> tag in the html and paste that back in the form, you'll get an password box. But, I haven't tried submitting the form

Found a way do what I want.

It involves handling the controls created event of the xform, looping through all the controls to find the one I want, then just adding the type = secret attribute to the control!