userPassword

Octet string known only to the user and the system to which the user has access.

Applications should prepare textual strings used as passwords by transcoding them to Unicode, applying SASLprep as described in RFC 4013, and encoding as UTF-8. The client must determine whether a password is a textual string.

Passwords are not encrypted during transport. If the underlying transport is not secure, transmission can result in disclosure of the password to unauthorized parties.