diff --git a/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php b/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
index 6a24454..be6c9a0 100644
--- a/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
+++ b/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
@@ -183,6 +183,10 @@ public function denormalize($data, $class, $format = NULL, array $context = arra
       // Get the class of the field. This will generally be the default Field
       // class.
       $field_class = get_class($field);
+      if ($field_class == '\Drupal\Core\Field\Plugin\Field\FieldType\PasswordItem') {
+        // Never normalize password items.
+        continue;
+      }
       // Pass in the empty field object as a target instance. Since the context
       // is already prepared for the field, any data added to it is
       // automatically added to the entity.
diff --git a/core/modules/serialization/serialization.services.yml b/core/modules/serialization/serialization.services.yml
index db6fbed..389ac05 100644
--- a/core/modules/serialization/serialization.services.yml
+++ b/core/modules/serialization/serialization.services.yml
@@ -20,10 +20,6 @@ services:
     class: Drupal\serialization\Normalizer\ListNormalizer
     tags:
       - { name: normalizer }
-  serializer.normalizer.password_field_item:
-      class: Drupal\serialization\Normalizer\PasswordFieldItemNormalizer
-      tags:
-        - { name: normalizer, priority: 20 }
   serializer.normalizer.typed_data:
     class: Drupal\serialization\Normalizer\TypedDataNormalizer
     tags:
diff --git a/core/modules/serialization/src/Normalizer/PasswordFieldItemNormalizer.php b/core/modules/serialization/src/Normalizer/PasswordFieldItemNormalizer.php
deleted file mode 100644
index a800084..0000000
--- a/core/modules/serialization/src/Normalizer/PasswordFieldItemNormalizer.php
+++ /dev/null
@@ -1,31 +0,0 @@
-<?php
-
-/**
- * @file
- * Contains \Drupal\serialization\Normalizer\PasswordFieldItemNormalizer.
- */
-
-namespace Drupal\serialization\Normalizer;
-
-/**
- * Dynamic entity reference normalizer.
- */
-class PasswordFieldItemNormalizer extends NormalizerBase {
-
-  /**
-   * The interface or class that this Normalizer supports.
-   *
-   * @var string
-   */
-  protected $supportedInterfaceOrClass = 'Drupal\Core\Field\Plugin\Field\FieldType\PasswordItem';
-
-  /**
-   * {@inheritdoc}
-   */
-  public function normalize($object, $format = NULL, array $context = array()) {
-    $field = $object->getParent();
-    // We don't return the password hash.
-    return NULL;
-  }
-
-}
diff --git a/core/modules/serialization/src/Tests/EntitySerializationTest.php b/core/modules/serialization/src/Tests/EntitySerializationTest.php
index 0f3bdb5..db0c944 100644
--- a/core/modules/serialization/src/Tests/EntitySerializationTest.php
+++ b/core/modules/serialization/src/Tests/EntitySerializationTest.php
@@ -117,7 +117,7 @@ public function testNormalize() {
     ]);
     $account->save();
     $normalized = $this->serializer->normalize($account);
-    $this->assertEqual($normalized['pass'], [[]]);
+    $this->assertTrue(empty($normalized['pass']));
   }
 
   /**