Once a password field has been set in a process step in Octopus, there is no way to clear it or replace it with a custom field. The only option is to delete the step and recreate it.
Steps to reproduce:
Create a new step which needs a password in a process (eg: IIS Virtual Directory – Create)
Set the password and save the step.
Reopen the step and clear the password and save.
On reopening the step, the password persists.