Password fields are not annotated with type="password" in web semantics. Without it screen readers fail to describe the field as a password field to the user, treating all fields as plain text fields.