ADDITIONAL SYSTEM INFORMATION :
Mac OS X, Java 1.8.0_172 and previous versions (also happens in debian-based linux systems)

A DESCRIPTION OF THE PROBLEM :
When keytool output is piped through grep (for instance to discover if a particular alias exists within the keystore) the password masking is disabled and the typed-in password is seen as plain text.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute a command similar to the following:

$ sudo keytool -list -keystore ./lib/security/cacerts|grep somealias

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
When a password to the keystore is typed in, no characters are seen.
ACTUAL -
When a password to the keystore is typed in, it is seen in clear-text.

FREQUENCY : always