I don't think you can apply a mask to the InputBox(). Another approach would be to create a little modal form with a text box to accept the password entry. At this point you are adding an additional layer of complexity. If the true purpose of having a password entered is to permit the user to think about deleting the record, then just use the Inputbox() method as opposed to a password form.
The better approach would be to have a login page to capture a user name/password then check a database table which has what rights a user has. For example, they can delete records from one form/table, but not others. Then before the delete action is executed, check the user rights table to see if they have permission to perform the delete.
It really depends if you are building a tool or a system.
htwh... Steve Medvid
"IT Consultant & Web Master"