This question already has an answer here:
What is the convention for showing toggle icons to a user? This question is specific to password unmasking, but it can easily be used in "on / off" icons et al.
In our situation, we have an unmask button at the end of a password field. The password is masked by default, and the icon is an open eye indicating "if you click me, you will see what's behind the curtain" Then the inverse is true when the password is unmasked. The eye is closed, indicating "if you click me, we will hide your password".
see the following two images.
for the user's experience, is this the right approach for this situation, or should it be the opposite?
eye closed icon
eye open icon
note: we're additionally using a title attribute on the button that says "show password / hide password"