You don't need to only hope echo is builtin. You can enforce it:

$ builtin echo "$PW" | the-command-that-reads-pw-from-stdin