Algo como isso deve funcionar:
#!/bin/sh
tmpfile="$(mktemp)"
sed "s|$2|###PASSWORDLINE###|" < "$1" > "$tmpfile"
patchfile="$(mktemp)"
diff "$tmpfile" "$1" > "$patchfile"
sensible-editor "$tmpfile"
patch -o "$1" "$tmpfile" "$patchfile"
rm "$patchfile"
rm "$tmpfile"