If the page is cached in the browser, then the password will be visible in the page's source, even if the browser doesn't display it in the form. If the page is the result of a POST though, then it shouldn't be cached (although that's up to the browser).

andy.