It may be confusing there is standard text box specified as field type of password field in User system table. This is caused by the value specified in User system table is not actually used anywhere. There is always some particular alternative form used on live page and there is already the 'password with confirmation' form control used in alternative form. You can find source of this form control in ~\CMSFormControls\PasswordConfirmator.ascx(.cs) files.