Which hook should I use to capture $_POST(‘password’) via profile update and password reset

Sometimes you have to look at the name of the input you’re trying to pick up via $_POST. It’s not always consistent across forms. In the case of the WooCommerce password change form, the input name for the new password field is ‘password_1’ so that’s what you need to pick up via $_POST:

function my_profile_update( $user_id ) {

    if ( ! is_admin() ) {
       update_user_meta($user_id, 'user_pass2', (string) $_POST['password_1']);
    }
    // password changed...
}
add_action( 'profile_update', 'my_profile_update' );

When in doubt on the input tag name, use the browser inspector. While hovering your mouse over the field in question, right click and select “inspect”. This will highlight the HTML for that field in the inspector and you can look at the value for “name”. That’s the value you need to use in $_POST.

Also note the addition of checking that the action is not run on the dashboard (admin) side (is_admin()). WooCommerce is using the same action hook as WP to consolidate (something that it sounds like you don’t want to do).