Use wpa_supplicant without plain text passwords

wpa_passphrase [ ssid ] [ passphrase ] generates a WPA PSK from an ASCII passphrase for a SSID. Then store it as

network={
        ssid="your ssid"
        psk=outputfromabove
}

Alternatively, you can leave the password entry blank. If you're running wpa_gui, it will prompt you for the password. (I do this with eduroam accounts, as my password is the same as my *nix login)