Password column from sys.user$ is null in 18c, why?
Check the SPARE4 column.
Quoting from https://www.experts-exchange.com/articles/855/How-Oracle-Stores-Passwords.html

11g introduces new security and the ability to support case sensitive
passwords.
First, DBA_USERS no longer exposes the PASSWORD value, instead it will
be NULL and you will have to go to SYS.USER$ to find the hash value.
However, if your PASSWORD_VERSIONS does not contain 10g then
SYS.USER$.PASSWORD will not be reliable.  The reason is the hashing
algorithm populating that field doesn't support case sensitivity.  So,
regardless of the sensitivity setting and regardless of the upper or
lower case of your password the hash will be the same.  If your
PASSWORD_VERSIONS is 11g only then you will need to look in the
SYS.USER$.SPARE4 column and you will see a much larger hex number.
This is because Oracle has switched to the SHA-1
(http://en.wikipedia.org/wiki/SHA-1) algorithm.