<%= form_tag( :action => 'search' ) do %>
    Password:<%= password_field_tag :pass1, nil , :size=>'20'%><br/>
    Password:<%= password_field_tag :pass2, nil , :size=>'20'%><br/>
    <%= submit_tag %>
<% end %>
then you can access the values from you controller, like this:
Whenever you have a page that sends confidential information back and forth you have to encrypt it, because when a user hits submit, the html goes back to the server in pure text and can be read by anyone along the way to the server. What is done is that PKI infrastructure is used to ensure no one in the network can intersect the data an read it.
Google SSL, TLS , PKI, Certificates, CA and encryption.
HINT: pages with ssl show a little lock in the status bar of the browser