Interesting discussion internally at this end re a sign-up/login mechanic that will be running within a public kiosk/display application.

The question we have is related to whether or not we should attempt to obfuscate the entry field where users enter their email address. There are some concerns that because the user will be interfacing with the application in a public space that:

  1. Open display of an email address might lead to 'snooping' with other members of the public looking over the shoulder of the user, gaining access to the exposed an email address
  2. Users might be hesitant to enter their email address because of the above

Current train of thought would be to obfuscate the email address as the user enters it - ie showing on ly the character just entered, swapping it out for an appropriate * character as the user moves through the different key-presses of entering their address. This does however present problems with accuracy as in doing so potentially increases the possibility that users will make mistakes/typos in their address. This is turn then makes the correction/validation process more difficult because for the reasons listed above we don't want to display the entire email in clear text.

Therefore, I'm looking to seek some thoughts and opinions from the wider UX community on this. Is this a case of over thinking the situation, or are we correct to have these concerns and look to address these in the experience design of the application.

To add further complexity to the situation, the 'kiosks' are actually touch-screen TVs ranging in size for 32" to 80", so a hard-ware related solution such as privacy screens is unlikely to be un-workable.

  • When would it be important for any user to hide their email address?
    – Fractional
    Commented Nov 13, 2013 at 13:50
  • Does that mean that a polarized privacy filter laminate over the screens is not an option? That would be my solution and leave the UI out of it.
    – Itumac
    Commented Nov 13, 2013 at 17:47
  • unfortunately - as the screens range between 32" and 80" this isn't workable. On smaller screens this would off course be the best option Commented Nov 14, 2013 at 21:15

3 Answers 3


Why not give the user the option of hiding/showing the email address?

A simple checkbox option that allows the user to toggle between the states allows the user to decide based on their preferences for privacy and the local circumstances.


enter image description here

All that remains if for you to decide is:

1) Is the default show or hide?

2) Whether to use 'hide my email' or 'show my email'

  • I don't like putting the onus and decision on the user. Especially in a the kiosk scenario where the user is likely no familiar with the system and I assume uses it once. Solve for this and leave the user out of it.
    – Itumac
    Commented Nov 13, 2013 at 17:44
  • @Itumac that why you have a sensible default and allow the user to alter it, if they so wish.
    – Fractional
    Commented Nov 14, 2013 at 9:11
  • I like your idea of letting the user decide before interacting, if he wants his input to be readable or not. And he is still able to toggle between the de- or encrypted version at any time.
    – uxfelix
    Commented Nov 14, 2013 at 10:06
  • This feels like a very user friendly solution and allows for toggling easy between the two states. Hidden by default feels the most security aware, but there's a part of me that feels it might confuse a user who is perhaps less comfortable/familiar with the methodology in play here Commented Nov 14, 2013 at 21:20
  • It's a very discoverable action
    – Fractional
    Commented Nov 15, 2013 at 9:37

You could use your described system (hiding every entered character after input) but still showing every special symbol as in dots, slashes, underscores etc. giving the user the opportunity to check the length before and after those characters. Further I think it would be ok to show the TLD.

Additionally - since you are using a touch screen - you could let the user touch and slide over every "•" revealing the underlying character.

For example:

The whole goal here would be not to let shoulder surfers get a glance of the entire email address since "[email protected]" is easier to remember than "••.••m•@••••••.com

  • I like this concept, as it gives plenty of clues to user to indicate the formatting without exposing the full clear text of the address. The touch screens are also large enough that the useability difficulties the click/hold to reveal presents on some mobile screens. Commented Nov 13, 2013 at 16:35
  • 1
    Good solution...I would delay the obfuscation either until the next key stroke or for a short time so the user gets feedback on the letter they typed. Once signed in, be sure to display the email in the same way if you need to. Finally, perhaps you could incorporate the Win8 "eye" icon feature that reveals the text entry when the icon is tap and held.
    – Itumac
    Commented Nov 13, 2013 at 17:59
  • @Itumac I find it amusing that you suggest here that the user be allowed to reveal their email address, but in the comment to my answer you say that you don't like the ability for the user to decide. Seems a little inconsistent?
    – Fractional
    Commented Nov 14, 2013 at 9:53
  • RedSirius... I never said I was consistent :) But there is a subtle difference in each that makes a big difference in the UX. The check to hide is an "administrative" function for the application that demands user decision. The eye icon is a convenience feature that needs no attention. It is simply there if the user wishes to see their entry. Does that make sense?
    – Itumac
    Commented Nov 14, 2013 at 14:47
  • Nope, it's the same thing. Eye icon or checkbox the action is the same, except the eye icon is less discoverable.
    – Fractional
    Commented Nov 15, 2013 at 9:38

This might not actually be the answer you're looking for, but in my opinion I would question if it is appropriate to ask for an e-mail address when you are concerned about privacy. Maybe it's better to take that privacy problem away by removing the concerns in the first place. What I mean is, is it possible for instance to move the system to a place where nobody can peek over the shoulder while typing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.