Why reveal it
Small mobile keyboards cause typos, and masked dots hide them, letting action slips accumulate unseen (Norman, 1981). Nielsen (2009) argued masking increases errors and abandonment, and checking long passwords mentally strains memory (Miller, 1956). An eye icon lets users verify directly.
Balancing security
Unusable security pushes users to weak passwords or notes (Adams & Sasse, 1999; Inglesant & Sasse, 2010). NIST SP 800-63B (2024) recommends a show option and allowing paste. Users can judge shoulder-surfing risk themselves; mask by default and reveal on demand. Offering biometric login reduces typing further.
Design and accessibility
Place the toggle inside the field's right edge, clearly switching between 'Show' and 'Hide', preserving cursor and keyboard. Give it an accessible name and state per WCAG 2.2 (W3C, 2023) 4.1.2, and per 3.3.8 never block paste or password managers. Show rules via inline validation within mobile form usability principles.
FAQ
- Doesn't showing passwords weaken security?
- Risk is small since it's masked by default and revealed on demand; standards recommend it.
- Tapping the toggle moves the cursor to the start.
- Save and restore the cursor position when switching input type.
Sources reviewed: 2026-10-27
References
- Nielsen, J. (2009, June 23). Stop password masking. Nielsen Norman Group. Masking causes typos and abandonment.
- Adams, A., & Sasse, M. A. (1999). Users are not the enemy. Communications of the ACM, 42(12), 40–46. Users bypass unusable security.
- Inglesant, P. G., & Sasse, M. A. (2010). The true cost of unusable password policies: Password use in the wild. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 383–392). ACM. Costs of complex password policies.
- National Institute of Standards and Technology. (2024). Digital identity guidelines: Authentication and authenticator management (NIST SP 800-63B-4). Recommends showing passwords and paste.
- Norman, D. A. (1981). Categorization of action slips. Psychological Review, 88(1), 1–15. Slips in unseen typing.
- Miller, G. A. (1956). The magical number seven, plus or minus two: Some limits on our capacity for processing information. Psychological Review, 63(2), 81–97. Memory limits for long passwords.
- World Wide Web Consortium. (2023). Web Content Accessibility Guidelines (WCAG) 2.2. Criteria 3.3.8 and 4.1.2.