Is it a good idea to have an unmask checkbox for user selection when the users type their password to show them what they typed?
Yes, having such a password can be an accessibility aid for people with mobility issues. Just be sure you don't name it "unmask." Use user-friendly vocabulary like "Show my password."
On mobile, the consensus seems to be that this checkbox should default to display the password unmasked.
On desktop, it's probably better to default to hide the password in keeping with convention, although it's notable that usability expert Jacob Nielsen advocates for unmasking all passwords by default because masked passwords makes users feel less confident, which
- leads to lost business.
- negatively impacts security because users choose shorter passwords or copy and paste passwords from their computer.
Nielsen also notes that if someone really wants to know your password, they can just look at your keyboard instead of your screen, which means that on-screen masking could give a false sense of security.
Yes, theoretically it's better from a UX perspective. But in general it's worse, as it can lead to security issues. An unmasked password field may let others see it when peeking from behind the user's back.
It is actually balancing between security and UX, as the last paragraph of this article says: http://uxdesign.smashingmagazine.com/2012/10/26/password-masking-hurt-signup-form/
Passwords are sensitive information and they should remain masked. My recommendation is not to let users do it. Or, if a compromise is needed between UX and security: hiding the password with a delay, e.g. the last character typed could be replaced with a mask after one second.
The answer depends on your application, of course. But if you have to opportunity to study your users in this regard, do it. That data will be much more useful than general recommendations.
If you can't perform any studies, there's always the general recommendations. Nielson thinks we should stop masking passwords. This report contains some good data and very helpful observations, though some of the assertions are over-generalized and logically problematic.
And as always, you should evaluate any generalized recommendations against the specific context of your application.
Questions to ask yourself:
- What are your users' expectations regarding passwords and security?
- How secure does your application need to be?