"What can I do so the characters can't be seen when a user types a
password?" is a frequent question.  [Tk] applications have a complete
and simple answer:  use [entry]'s -show option. For a usage example, see [A little login dialog].

A [pure-Tcl] solution is slightly subtler.  In a Unix context, the
formula is
        exec stty -echo / echo
[[elaborate, including [signal] hygiene ...--which [Expect]
handles by itself]]

"stty -echo ..." is an error-prone subject.
[Don Libes] and marsd describe, for example, a long-standing
problem that continues to plague Linux 2.4.12
[http://groups.google.com/groups?hl=en&lr=&frame=left&th=5433ad0c03fdc370].

The [Unix Terminal Extension] provides the ability to disable echoing, as well as the ability to read one character at a time from stdin.  See [terminal:password:get] for an example.