Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why do some websites (especially banking sites) display more characters in the password field than were actually typed? This is sometimes apparent just after clicking the login button.

share|improve this question
What on earth are you talking about? This doesn't make any sense, the password is what you type by definition. – Gilles Nov 4 '13 at 20:17
@Gilles It's a web development question. The feature he's referring to is when you exit the password field the number of "stars" visible in the password field is normalized, so that no matter whether your password is 4 characters, or 8, or 16, once you've typed your password and moved to the next field, the app will adjust the apparent password length so that you see, say, 12 stars. – Xander Nov 4 '13 at 20:32
@Xander Oh, is that what it means? Please edit the question then. – Gilles Nov 4 '13 at 20:37
For those downvoting, please bear in mind that not everyone has English as a first language! You can flag the question instead, and someone with edit privileges can then reword and clarify the question. – scuzzy-delta Nov 4 '13 at 22:36
@Xander It's not just websites, and not always "normalizing". Some software randomizes the apparent length of each character as you type. All of this is, one can only presume, to obfuscate the length of the password to shoulder-surfers. – Iszi Nov 5 '13 at 2:25
up vote 3 down vote accepted

Some online banks, and some other web services, clear the password field and/or replace with a fixed number of characters so that if (for any reason) the login form submission failed or the user double clicked on the Login button then he won't be able to make the same submission again. The "rationale" behind it seems to be that they don't want the password to stay in the user's browser for more than needed.

To me, it actually doesn't make sense at all. But, then again, some online banks enforce a number-only password policy, which doesn't make sense at all.

This is usually done using JavaScript, something along the lines of

loginForm.elements[3].value = '00000000000000000000000000';
share|improve this answer
Thanks much @Adnan. – Purushoth Nov 6 '13 at 15:20

Another reason password entry fields (not limited to banks' web sites; I've seen several native PC applications, notably Lotus Notes, do this) are sometimes filled with random numbers of characters is to prevent anyone from shoulder-surfing the length of one's password and using that information to narrow the scope of passwords to try.

share|improve this answer
OP is talking about what happens the second you click "Submit" or "Login". The case with Lotus Notes and its likes is different. – Adi Nov 5 '13 at 8:05
"to prevent anyone from shoulder-surfing the length of one's password and using that information to narrow the scope of passwords to try", yes this makes sense. Thanks @Mike McManus. – Purushoth Nov 6 '13 at 15:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.