When validating a PasswordTextField from within Form.validate(), be sure to use the right method to get the entered value. Both getValue() and getInput() will get you the raw input strings. getModelObjectAsString() will get you either an empty string or, if nothing was entered in the field, the value entered before this call (even if you set required to false).
In Form.onSubmit(), where you will probably process the entered value further, the situation is a little different. getValue() will get you an encryption of the entered value (which you should not use to store the password in a database, use SHA instead). getModelObjectAsString() will always get you the entered value as provided by the model. getInput() will still get you the raw entered data.
Bottom line: always use getInput() when processing PasswordTextField.