Actually, EmptyMessage is currently not supported for Password textboxes and should not be displayed at all, we will have to fix this (I have updated your Telerik points for this bug report).
The current implementation of RadInput does not allow EmptyMessage for password textboxes, because browsers do not allow the type of a password textbox to be changed, so that the message becomes readable. This scenario requires some trickery, e.g. to two textboxes and switch their visibility. We will think about implementing such feature in the future. Thank you for this proposition.
the Telerik team
Check out Telerik Trainer
, the state of the art learning tool for Telerik products.