Password.readPassword() uses the Console.readPassword() method so that inputs are not echoed on screen. Unfortunately, System.console() goes null when stdin or stdout is redirected. While it's acceptable for the password to be read from a pipe when stdin is redirected, it seems not user-friendly when stdout is redirected and the password input shows on screen.

$ keytool -export > cert
Enter keystore password: topsecret