Why do some password fields allow users to see what they type while others do not?

Question

When I type a password somewhere, I see placeholders (black dots) in place of characters. But sometimes, there is also a toggle button to view the password like in a regular input field (typically an icon with the shape of an eye, or a text like "View password"). I've seen this kind of fields mostly in browsers.

On the other hand, it seems that other password fields do not have such an option, and I don't see a clear reason why (For example, when I enter a WIFI password in my Android mobile, I cannot read what I type, and I hate that).

My question is, why do some UIs allow you to see a password while you type it while others do not?

Or maybe in other words, how does a developer/security engineer decide if a password field should include a toggle to view the password as plain text or not?

Answer 1

The traditional way when entering passwords was to give either no feedback at all or to give a replacement character instead of the real one, typically a star. The idea behind this is to make shoulder surfing harder. But it of course impacts the usability, i.e. the user cannot easily see if they entered the wrong password.

Because of this usability issue in the recent years more and more password fields (or other sensitive data fields) added an option to show the password - either as a on/off toggle or by only showing the password when clicking on some symbol and then immediately hiding the password again when releasing the mouse button.

But for example the HTML input element for passwords hasn't this capability builtin. Same seems to be true for secure text fields in iOS. Thus it is always some additional effort by the developers to implement this feature. It might be simple to reach though depending on the framework used.

This means in most cases a missing option to toggle password visibility is either because the interface is old or because the developers just used the default behavior. Only rarely it is a deliberate decision not to provide this option and even then the decision might be questionable. The result is that for seemingly same things the user have the option for password display on some applications or platforms but not on others.

Answer 2

Some password entry fields don't supply placeholders either.

Reasons to not give feedback during password entry:

• Observers can use this to help guess the password.
• Implementing a feedback mechanism in the UI is extra code.
• Traditional password entry mechanisms did not have a complex UI.

Reasons to give feedback:

• Some users are confused when nothing happens when they type.
• Showing the password (or any feedback) helps correct typos, and is safe if you are sure there are no observers.
• Showing limited feedback is not much worse than allowing external observers see you type.
• Feedback that doesn't correspond exactly with typed characters might help obscure typing, and with care, won't confuse the user much.