I've noticed that on a lot of login forms in websites and applications that there is a "show password" check box. Why? I myself have seen some hacks that an attacker could hack the input password box. Doesn't enabling the "show password" box constitute as a security risk?

  • I myself have seen some hacks that an attacker could hack the input password box. Could you expand on this? Dec 23, 2013 at 18:10
  • @AbeMiessler, Someone showed me once, how he 'hacked' the password box. But later on he explained that it was just with Firebug(forgot how he hacked it). he changed the type="password" to type="text". Nothing special
    – blade19899
    Dec 23, 2013 at 19:36
  • @AbeMiessler, here is a howto. He's using Chrome, but still the same: totallynoob.com/…
    – blade19899
    Dec 23, 2013 at 19:44

1 Answer 1


The 'show password' option is a feature designed for better user experience. This started getting popular with the recent rise in numbers of mobile devices. The small on screen keyboards are notoriously difficult to type with, and when you are unable to see your input it can make it difficult to be sure the password was typed correctly.

I am not sure of any attacks that target readable password fields. In my opinion, if you have malware on your computer that can see your screen, then its quite probable they are capturing your keystrokes as well.

Is it a risk? Yes. This should never be the default behavior, but if a user feels they are comfortable displaying their password (secure in their physical envirioment), then I see no problem with this practice.

This is just my opinion, not a rule.

  • Follow up question: Why not post that answer in the dupe-source question? It's clearly referenced in Terry's comment. The question will get bumped up and your answer will get your sweet upvotes.
    – Adi
    Dec 23, 2013 at 15:41
  • I should have checked that before replying, thanks. It looks like Terry's answer is more than complete anyways. Thanks for those sweet upvotes though. Dec 23, 2013 at 17:04

Not the answer you're looking for? Browse other questions tagged .