Use POST method in your form tag, like this:

<FORM METHOD='POST' ACTION='http:.....'>
...
<FORM>
[download]

and
use SSL to encrypt your password during transmission. POST method will help you hide the password, but it will be transmited through Internet in plaintext unless you use SSL.
Reffer to your web server documentation on using SSL.