Setting a VM password in vRA Blueprint?

HI, I'm wondering what other people typically do when setting passwords on VMs using Blueprints?

At present I prompt the end user for a password (custom property, no encrypt) and pass this to WFStubMAchineProvisioned workflow which calls a powershell script. This script does some customisations on the VM but also sets the root password. This all works very well.

I'm trying to find a way to make this more secure but not sure how or what will decrypt?. Or maybe its possible not to have the custom property visible at least??

Any help is always appreciated

Thanks and regards

Steve