How to check following things using Solidity:
- Password matching (hash formed)
- if password matches then transfer take place
No data on the Ethereum blockchain should be considered private, so storing something like passwords is a bad idea, even in hashed form.
However, when a user sends a transaction to a smart contract, you can be ensured that it's actually coming from that user, since they need to have the private key in order to send a transaction.
In that way, Ethereum itself acts as an authentication layer, removing the need to store passwords for authentication.
You can combine this with some form of authorisation by storing a list or a mapping of Ethereum accounts that are authorised to send transactions or execute other operations on the smart contract.