This question already has an answer here:
The two most common behaviors I see in password entry fields are:
- For each character typed display an asterisk in the password entry field.
- Display nothing at all in the entry field.
The approach of displaying nothing at all in the entry field can be a risk because it means if focus is somewhere else, the user may unknowingly type their password in a place where it shouldn't have been.
I know displaying the asterisk characters makes it easier for a shoulder surfer to figure out how long a password you are using. But to me that sounds like a very weak argument. If the password is short enough for that to matter it would be weak even if the adversary doesn't know the length of the password.
Are there any other security arguments in favor of having no feedback in the password entry field?