They can get it regardless of the password unless you have wpa3 and then it's still possible with an evil twin.
@ilovethelight316