Passwords for what, exactly? The only credential type info I've stored is token/key/secret information for integrations. For those I do use the custom record locked down to Admins.