Do not show password, during login, on an insecure channel (without SSL). Use a SHA-256 hash algorithm.

External Login allows users to log in to the WordPress site with a different database of users.

Do not show password on login page.