This command will read into var pwd from stdin (with echo disabled):
IFS= read -s -p Password: pwd
Unsetting IFS will allow for leading and trailing whitespace in passwords (which may be supported in some environments, so best to support it during your script's input of the user credentials)
To validate leading/trailing whitespace is handled appropriately you can use:
echo -n "$pwd" | hexdump -C
Note: don't use with real passwords as it dumps to the console!
HT: Ron DuPlain for this additional information on IFS unsetting.