if this were done with SVG instead, you could deliver from the server a confusing looking SVG payload which is the password but as its rendered coordinates/vector art data. then you add two other wrong passwords to it too, and it would be very hard to decode by a bot, although possible. then you can animate it and change text colors and all sorts of fancy shit once your js kicks in.