I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it more secure. What can I do?
Don't do it? Passwords meant to be remembered not stored, and once you store them in extractable format (i.e. without hashing or other sort of many to one transformation) they become a less effective security measure.
As with any security related question, you have to start with defining what is it that you trying to protect against and only then you can decide how to set up your protection. If you store the password on your own hardware at home there is probably no problem with storing them as plain text (not much more then storing them in an excel file) but if you store it in some free hosting and you are in the habit of installing plugins without doing a security audit then probably nothing you can think of will be secure enough.
The hard truth here is: You can not. Every encryption method that has to be decrypted on-the-run is insecure. You write that the password has to be stored to access a third-party-service. So this password has to be decrypted at the runtime to access the service. This means that someone who gets to access your database or backend to read out wherever you stored it will probably be able to decrypt it.
If you want to make it safer, you can not do that much. Check if the service provides another access method, like OAuth 2 or similar.