Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Which browsers allow users to reveal passwords in password fields?

I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any other browsers with the "reveal password" feature, but do you know of any others?

Secondly I wonder Are there any UX best practices around passwords that could potentially be revealed?

My answer would be: The best practice is to not allow revealing the password in the input.

The main security risk exists for browsers that save passwords for users to use when auto-completing fields. This means a user might leave their desk and someone who knows their username could cause the password to be populated by auto-completion and then reveal the password using the browser feature.

share|improve this question
2  
I'd argue that any UX solution to attempt to fix 'lack of security of physical device' are always going to somewhat of a compromise. I could argue that other people sitting down to use someone's browser is not a problem the UI needs to solve. That's a problem the owner of the computer needs to solve. –  DA01 Apr 23 at 19:02
    
That's true, and I can't deny I find the show password feature very useful. However I agree with the OP that it does open up a pretty big security risk because it doesn't just let them into the site (as would autocomplete) but it actually shows the password itself. And (although it shouldn't be) it's probably reused on many other sites. –  Martin Hansen Lennox Apr 23 at 20:18

3 Answers 3

Chrome reveals passwords, although not directly, but through Settings › Passwords and Forms › Manage saved passwords. If I remember well, Firefox has the same feature as well. So in all cases, the user who leaves his desk to somebody exposes himself to a risk of password theft. Since the browser doesn't ask for a master password, it means that it keeps them somewhere, plain text, thus the risk.

UX best practices are mostly related to hiding password from somebody nearby who can see your screen (which can also be a surveillance camera in a public place). This translates to stars in Windows XP and earlier and circles in Windows Vista and later, or to the characters being not displayed at all in Linux console (which also means that one can't know the length neither).

As for the revealing, the only UX concern related to security that I can see is to avoid the person to reveal the password by mistake, or to keep it revealed. That's why in Windows 8, the eye icon doesn't toggle between plain password and circles, but reveals the password only at mouse down event, and hides it again when the user releases the mouse button.

share|improve this answer

The best practice is to not allow revealing the password in the input

Don't be so sure. Jakob Nielsen presents the case for not masking passwords at all (emphasis his):

When you make it hard for users to enter passwords you create two problems — one of which actually lowers security:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

The article isn't without its detractors (here's a good, deep analysis of the security implications of the proposal).

To answer your particular question, all browsers on OS X theoretically allow users' passwords to be shown in plain text (via the Keychain Access utility), but not within the browser. There is a Firefox Add-on called Show Password, a Chrome Extension called HTML Revealer and Password Revealer, and a Safari Extension called ShowPass all designed to emulate the same function in their own ways.

share|improve this answer

If you ask this question on security.stackexchange, the answer will be definite - don't reveal password, ever. It's akin to the poor practice of clicking forgotten password and being emailed your plain-text password, rather than a set of instructions on resetting it. While a user may get frustrated with this UX (Why can't I just see my password right now? Why do I have to reset my password?), security best practices are more important.

Incidentally, any browser allows you to reveal your password due to the mutable nature of DOM (document object model, a in-browser representation of page html). I've used this many-a-time whenever Chrome has better memory than I (normally my "user story" is that I have to log in from another device, and don't remember the password). To test this, go to any login page that your browser stores credentials for, like office365 below:

before tampering

You may have to type in your username before the password asterisks appear, now inspect the password field (in most browsers it's done via right click -> inspect element). If you delete the type="password" attribute, the password field will default to a vanilla text input and you will see the field's value in cleartext. I'm not adding that screenshot though :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.