The idea behind masking is that someone may be watching your screen (from behind you).
(Couldn't find an existing answer with this, even though I am sure I saw it here once, the is the closet I found is Ben Brocka's answer here.)
You could let the users elect to unmask or use the same trick used in mobile phones (temporarily unmasking the last character). (See Jonathan Dickinson's answer and Monica Cellio's answer.)
- Both these methods are risky if you are using a normal size screen in a public location and the purpose behind the last character unmasking in mobile phones is to prevent typos created by the keyboard being to small and not having enough physical feedback.
- Further more, both options are useless if you are not using alphanumeric characters or you are using a spatial keyboard pattern.
The reasoning behind confirmation of the password is to help prevent mistyping.
As Dean wrote here displaying the password to users isn't good enough (depends on convention used for the password).
A password resetting process can be tiring and besides, the user may have mistyped his/her email address too (and that really shouldn't be confirmed: http://ux.stackexchange.com/a/21063/687).
Also, remember that password resetting can lead to security risks: http://ux.stackexchange.com/a/21744/687
Making the user type the password out twice isn't such a bad option - it can be checked via script before the user even hits the next button (e.g. as soon as the user exits the field).
It gives users the chance the use their same method (for conceiving a password) over and confirms the result is the same.
If the password is too complex to type twice, you are probably forcing your user to use illogical password complexity rules e.g. entering 8+ lower case and upper case letters and numbers when the complexity of passwords is actually about the same for:
- 11 letters all upper or all lower case.
- 9 letters both upper and lower case.
- 10 letters all upper or all lower case + numbers.
- 8-9 letters both upper and lower case + numbers.
- 8-9 symbols from all 32 symbols in US keyboards + letters all upper or lower.
- 8-9 symbols from all 32 symbols in US keyboards + letters all upper or lower + numbers.
- 8 symbols from all 32 symbols in US keyboards + letters both upper and lower + numbers.
- 9-10 symbols from 16 in top row only + letters + letters all upper or lower.
- 9 symbols from 16 in top row only + letters + letters all upper or lower + numbers.
- 8-9 symbols from 16 in top row only + letters + letters both upper and lower.
- 8 symbols from 16 in top row only + letters + letters both upper and lower + numbers.
- 3 random words in modern English