diff --git a/config/install/webform.settings.yml b/config/install/webform.settings.yml
index 33814844..17e979ee 100644
--- a/config/install/webform.settings.yml
+++ b/config/install/webform.settings.yml
@@ -120,7 +120,9 @@ element:
   default_empty_option_optional: ''
   default_icheck: ''
   default_google_maps_api_key: ''
-  excluded_elements: {  }
+  excluded_elements:
+    password: password
+    password_confirm: password_confirm
 html_editor:
   disabled: false
   format: ''
diff --git a/includes/webform.install.update.inc b/includes/webform.install.update.inc
index d137e350..22efd333 100644
--- a/includes/webform.install.update.inc
+++ b/includes/webform.install.update.inc
@@ -2030,3 +2030,30 @@ function webform_update_8109() {
     \Drupal::service('module_installer')->install(['webform_image_select']);
   }
 }
+
+/**
+ * Issue #2947991: Disable the password field.
+ */
+function webform_update_8110() {
+  $config_factory = \Drupal::configFactory();
+  $has_password_element = FALSE;
+  foreach ($config_factory->listAll('webform.webform.') as $webform_config_name) {
+    $webform_config = $config_factory->get($webform_config_name);
+    $elements = $webform_config->get('elements');
+    // Check for password and password_confirm element #type.
+    if (strpos($elements, "'#type': password") !== FALSE) {
+      $has_password_element = TRUE;
+      break;
+    }
+  }
+
+  // If password element is not being used in any webform display both the
+  // password and password_confirm element.
+  if (!$has_password_element) {
+    $admin_config = \Drupal::configFactory()->getEditable('webform.settings');
+    $excluded_elements = $admin_config->get('element.excluded_elements') ?: [];
+    $excluded_elements['password'] = 'password';
+    $excluded_elements['password_confirm'] = 'password_confirm';
+  }
+}
+
diff --git a/modules/webform_examples/config/install/webform.webform.example_style_guide.yml b/modules/webform_examples/config/install/webform.webform.example_style_guide.yml
index 784c0416..43c6746e 100644
--- a/modules/webform_examples/config/install/webform.webform.example_style_guide.yml
+++ b/modules/webform_examples/config/install/webform.webform.example_style_guide.yml
@@ -108,12 +108,6 @@ elements: |
         two: Two
         three: Three
       '#icheck': minimal
-    password:
-      '#type': password
-      '#title': Password
-    password_confirm:
-      '#type': password_confirm
-      '#title': 'Password confirm'
   date_elements:
     '#type': details
     '#title': 'Date elements'
diff --git a/src/Form/AdminConfig/WebformAdminConfigElementsForm.php b/src/Form/AdminConfig/WebformAdminConfigElementsForm.php
index ee600a0d..d6560a61 100644
--- a/src/Form/AdminConfig/WebformAdminConfigElementsForm.php
+++ b/src/Form/AdminConfig/WebformAdminConfigElementsForm.php
@@ -400,6 +400,29 @@ class WebformAdminConfigElementsForm extends WebformAdminConfigBaseForm {
     $form['types']['excluded_elements']['#header']['title']['width'] = '25%';
     $form['types']['excluded_elements']['#header']['id']['width'] = '25%';
     $form['types']['excluded_elements']['#header']['description']['width'] = '50%';
+    // Add warning to all password elements.
+    foreach ($form['types']['excluded_elements']['#options'] as $element_type => &$excluded_element_option) {
+      if (strpos($element_type,'password') !== FALSE) {
+        $excluded_element_option['description'] = [
+          'data' => [
+            'description' => ['#markup' => $excluded_element_option['description']],
+            'message' => [
+              '#type' => 'webform_message',
+              '#message_type' => 'warning',
+              '#message_message' => $this->t('Webform submissions store passwords as plain text.') . ' ' .
+                $this->t('Any webform that includes this element should enable <a href=":href">encryption</a>.', [':href' => 'https://www.drupal.org/project/webform_encrypt']),
+              '#attributes' => ['class' => ['js-form-wrapper']],
+              '#states' => [
+                'visible' => [
+                  ':input[name="excluded_elements[' . $element_type . ']"]' => ['checked' => TRUE],
+                ],
+              ],
+            ],
+          ],
+        ];
+
+      }
+    }
 
     // Element: Format.
     $form['format'] = [
diff --git a/src/Plugin/WebformElementBase.php b/src/Plugin/WebformElementBase.php
index 7cac7dc9..4c6ccb3d 100644
--- a/src/Plugin/WebformElementBase.php
+++ b/src/Plugin/WebformElementBase.php
@@ -18,6 +18,7 @@ use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\Url;
 use Drupal\webform\Element\WebformHtmlEditor;
+use Drupal\webform\Element\WebformMessage;
 use Drupal\webform\Entity\WebformOptions;
 use Drupal\webform\Plugin\WebformElement\Checkbox;
 use Drupal\webform\Plugin\WebformElement\Checkboxes;
@@ -2692,6 +2693,20 @@ class WebformElementBase extends PluginBase implements WebformElementInterface {
       }
     }
 
+    // Add warning to all password elements that are stored in the database.
+    if (strpos($this->pluginId, 'password') !== FALSE && !$webform->getSetting('results_disabled')) {
+      $form['element']['password_message'] = [
+        '#type' => 'webform_message',
+        '#message_type' => 'warning',
+        '#message_message' => $this->t('Webform submissions store passwords as plain text.') . ' ' .
+          $this->t('<a href=":href">Encryption</a> should be enable for this element.', [':href' => 'https://www.drupal.org/project/webform_encrypt']),
+        '#access' => TRUE,
+        '#weight' => -100,
+        '#message_close' => TRUE,
+        '#message_storage' => WebformMessage::STORAGE_SESSION,
+      ];
+    }
+
     return $form;
   }
 
diff --git a/src/Tests/Element/WebformElementStatesSelectorsTest.php b/src/Tests/Element/WebformElementStatesSelectorsTest.php
index c8d071f9..3c6870e6 100644
--- a/src/Tests/Element/WebformElementStatesSelectorsTest.php
+++ b/src/Tests/Element/WebformElementStatesSelectorsTest.php
@@ -35,6 +35,11 @@ class WebformElementStatesSelectorsTest extends WebformElementTestBase {
 
     // Create 'tags' vocabulary.
     $this->createTags();
+
+    // Enable all elements, including password and password_confirm.
+    \Drupal::configFactory()->getEditable('webform.settings')
+      ->set('element.excluded_elements', [])
+      ->save();
   }
 
   /**