This command will read into var pw from stdin (with echo disabled):
IFS= read -r -s -p 'Password: ' pw
echo
The last echo adds a newline to the terminal output (otherwise next commands would appear in the same line as the Password: prompt.
Unsetting IFS allows for leading and trailing whitespace in passwords (which may be supported in some environments, so best to support it during your script’s input of the user credentials).
If you want, you can verify that the above works by running it with a fake password that includes whitespace and then printing the variable’s contents into hexdump:
printf '%s' "$pw" | hexdump -C
Note: don’t use with real passwords as it dumps to the console!
HT: Ron DuPlain for this additional information on IFS unsetting.