Are you looking at view-source: or are you looking at the actual DOM after it has been modified by JavaScript? The password field is created by JavaScript base

Are you looking at view-source: or are you looking at the actual DOM after it has been modified by JavaScript? The password field is created by JavaScript based on a template from the HTML source, and the password is filled in via a script; it's not sent in the base page.