XTEA: patterns in plain text
XTEA is a block cipher. It requires a block cipher mode of operation to work. Together with a block cipher mode of operation you can generate something that is secure. For this you require at least an IV, as you may otherwise encrypt identical passwords (for different users) to identical values. Or, if you encrypt each character separately, the same character value to the same ciphertext.

A block cipher itself is a PRP, a pseudo random permutation. Given a key, it will always transform one plaintext to the ciphertext associated with it. If you use XTEA in e.g. Block TEA this will not be different; you will always get the same ciphertext.

You can do the following things:


define a character set for your password and possible input values;
encode the password using the said character set
pad the password to a certain maximum length, say 64 bytes to allow for pass phrases (either store the length or use an invalid character such as 00 hex)
generate a 8 byte IV (for a 64 bit block cipher such as XTEA; IV requirements may depend on mode of operation and block size)
encrypt the encoded &amp; padded password using the IV and key
store IV | ciphertext


This should be secure, as long as the mode of operation you choose is secure. You may want to use authenticated encryption (e.g. GCM) for this, but that's not really a requirement.



Usually it is better not to store passwords at all, but this seems a requirement in your case. You may want to check if there are secure password faults available from the runtime environment. If there is no pressing argument for using XTEA, you should be using AES.