The alarm spell
Alarm creates a subtle ward on an area you select. Once the spell effect is in place, it thereafter sounds a mental or audible alarm each time a creature of Tiny or larger size enters the warded area or touches it. A creature that speaks the password (determined by you at the time of casting) does not set off the alarm. You decide at the time of casting whether the alarm will be mental or audible in nature.
So the password is chosen at the time of casting, but do you need to speak the password during casting or is it something that is chosen mentally? The reason I ask is if someone is watching, they could learn the password if it is spoken at the time of casting.