Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can.

I've noticed a new trend where mobile webapps don't request password confirmation and instead just show the password field in cleartext.

How is this perceived by the users? Does it not give a sense of insecurity?

share|improve this question
Related question: ux.stackexchange.com/questions/484/… –  Charles Boyung Apr 21 '11 at 14:52

6 Answers 6

up vote 4 down vote accepted

There are indeed many apps that have dropped the password confirmation field, but I'm not sure they have also switched to showing the password.

I think not having to confirm the password is a good thing:

  • Most mobile apps keep you logged in anyway (it's a personal device), so you'll rarely need the password again
  • You can always default to "forgot password" if there's a problem

So I would still show the field starred, but if you like, you can have a link or a switch saying "show password" (some password managers do that).

share|improve this answer
I disagree with this as if you're going to mistype a character, it will likely be when you're using a mobile device's keyboard. And that's probably the reason to remove the 'confirm' field--people hate typing on mobile keyboards. So I would suggest if you do drop the confirm field (which I think is good) one should also drop the masked field to prevent the typo issue. –  DA01 Dec 18 '12 at 17:52
I recommend defaulting to a masked field, but having a "reveal password" checkbox close by. This way the user can judge if they're in a secure enough environment to display an unmasked password. –  Matt Dec 18 '12 at 21:43

I wrote about this a while back: Fixing Registration & Login Forms – Passwords

Look at what Twitter does - they just ask you to choose a password, nothing more.

For mobile, I would say that the concerns that masking attempts to address are even less important. How likely is it that someone will be watching you type your password when using your mobile device? Even less likely than if you are using a laptop/desktop. Because of this, I really think just using a single normal text field is the best way to go for mobile. (I feel the same way for non-mobile, but that's a different story)

share|improve this answer
I agree...of all the security concerns on the web, the easiest one to prevent is telling the person breathing on your neck to stop looking at your screen. –  DA01 Apr 21 '11 at 16:03

I don't know the history of the masked password field and why it's become the norm other than I can see it making sense at first glance.

But it's REALLY annoying...especially on a mobile device where typing is difficult and you are constantly checking for spelling issues.

So, just the opinion of one web user, I'd rather all password fields be readable and not masked.

One option would be to mask by default, but offer a way to see it:

[ * * * * *       ]    ( ) show password

The only advantage to using an actual password field may be that the device won't automatically attempt to spell check it for you. It'd be interesting to know which devices do that and if there are ways to turn that off on a field-by-field basis.

share|improve this answer
There is. On Mobile Safari, for instance, you can specify autocapitalize and autocorrect properties for the <input> tag (set them as off) and it turns the field into a perfect, clear-text password receiver. Good for email too :-) –  changelog Apr 21 '11 at 18:22

Different mobile OS handle password display differently. For instance Android phones have a User setting that allows the user themselves to choose whether the password is displayed or hidden, whereas iOS does not (so all masked password fields are hidden).

You can probably bypass this option when setting up the form by not setting the field to Mask, but you should include a checkbox near the password field ('Hide My Password' for example) which, when checked, will turn on the Masking and hide the password.

Masking passwords is a convention that adds to the feeling of security for users, although at a detriment to usability.

share|improve this answer

Apple has done an excellent job of this on iOS devices and there are certainly mechanisms to accomplish this in the wild.


The way a password is viewed/stored is a usability concern of browser developers much more so than web developers though.

share|improve this answer

Make the password field clear text by default

  • Chances of sneak peeking & reading password is very rare.
  • If you can read from the text box you can might as well read from the big on screen keyboard
  • With this, no need for confirm password

Please make life easier for users

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.