--- a/mercurial/ui.py	Sun Nov 04 12:17:20 2018 +0900
+++ b/mercurial/ui.py	Sun Nov 04 12:38:49 2018 +0900
@@ -1464,7 +1464,7 @@
             return default
         try:
             self._writemsg(self._fmsgerr, prompt or _('password: '),
-                           type='prompt')
+                           type='prompt', password=True)
             # disable getpass() only if explicitly specified. it's still valid
             # to interact with tty even if fin is not a tty.
             with self.timeblockedsection('stdio'):