...uhh, yes they can? Are you talking about input type=password fields, i.e. the ones 99% of passwords are entered in?