I'm building a mobile web app that will request a bunch of information from the user (name, dob, address, etc) and am trying to cut down as much fields as I can.

I've noticed a new trend where mobile webapps don't request password confirmation and instead just show the password field in cleartext.

How is this perceived by the users? Does it not give a sense of insecurity?


7 Answers 7


There are indeed many apps that have dropped the password confirmation field, but I'm not sure they have also switched to showing the password.

I think not having to confirm the password is a good thing:

  • Most mobile apps keep you logged in anyway (it's a personal device), so you'll rarely need the password again
  • You can always default to "forgot password" if there's a problem

So I would still show the field starred, but if you like, you can have a link or a switch saying "show password" (some password managers do that).

  • 4
    I disagree with this as if you're going to mistype a character, it will likely be when you're using a mobile device's keyboard. And that's probably the reason to remove the 'confirm' field--people hate typing on mobile keyboards. So I would suggest if you do drop the confirm field (which I think is good) one should also drop the masked field to prevent the typo issue.
    – DA01
    Commented Dec 18, 2012 at 17:52
  • 3
    I recommend defaulting to a masked field, but having a "reveal password" checkbox close by. This way the user can judge if they're in a secure enough environment to display an unmasked password.
    – Matt
    Commented Dec 18, 2012 at 21:43
  • I thought Bruce Tognazzini's rolling blackout password was supposed to help with the typo issue.
    – Voxwoman
    Commented Feb 23, 2015 at 22:12

I wrote about this a while back: Fixing Registration & Login Forms – Passwords

Look at what Twitter does - they just ask you to choose a password, nothing more.

For mobile, I would say that the concerns that masking attempts to address are even less important. How likely is it that someone will be watching you type your password when using your mobile device? Even less likely than if you are using a laptop/desktop. Because of this, I really think just using a single normal text field is the best way to go for mobile. (I feel the same way for non-mobile, but that's a different story)

  • 2
    I agree...of all the security concerns on the web, the easiest one to prevent is telling the person breathing on your neck to stop looking at your screen.
    – DA01
    Commented Apr 21, 2011 at 16:03

I don't know the history of the masked password field and why it's become the norm other than I can see it making sense at first glance.

But it's REALLY annoying...especially on a mobile device where typing is difficult and you are constantly checking for spelling issues.

So, just the opinion of one web user, I'd rather all password fields be readable and not masked.

One option would be to mask by default, but offer a way to see it:

[ * * * * *       ]    ( ) show password

The only advantage to using an actual password field may be that the device won't automatically attempt to spell check it for you. It'd be interesting to know which devices do that and if there are ways to turn that off on a field-by-field basis.

  • 2
    There is. On Mobile Safari, for instance, you can specify autocapitalize and autocorrect properties for the <input> tag (set them as off) and it turns the field into a perfect, clear-text password receiver. Good for email too :-)
    – changelog
    Commented Apr 21, 2011 at 18:22

Different mobile OS handle password display differently. For instance Android phones have a User setting that allows the user themselves to choose whether the password is displayed or hidden, whereas iOS does not (so all masked password fields are hidden).

You can probably bypass this option when setting up the form by not setting the field to Mask, but you should include a checkbox near the password field ('Hide My Password' for example) which, when checked, will turn on the Masking and hide the password.

Masking passwords is a convention that adds to the feeling of security for users, although at a detriment to usability.


I agree: Stop making people confirm passwords, especially from Mobile.

Second, yes, display in Plaintext. Some good reading on password security and masking:


It's time to show most passwords in clear text as users type them. Providing feedback and visualizing the system's status have always been among the most basic usability principles. Showing undifferentiated bullets while users enter complex codes definitely fails to comply.


Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)

The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

Abandon Legacy Design Password masking has become common for no reasons other than (a) it's easy to do, and (b) it was the default in the Web's early days. In this respect, it's similar to another usability problem — having Reset buttons on forms, which is also something that should die.

  • Welcome! While it's good to link to resources, can you summarize the salient points and explain why you think it supports your answer? Link rot is real, it's better to try to put the value into the answer it stands the test of time! Commented Feb 23, 2015 at 20:48
  • Sorry Charles, will keep this in mind for future!
    – Kray
    Commented Feb 25, 2015 at 0:24

Apple has done an excellent job of this on iOS devices and there are certainly mechanisms to accomplish this in the wild.


The way a password is viewed/stored is a usability concern of browser developers much more so than web developers though.


Make the password field clear text by default

  • Chances of sneak peeking & reading password is very rare.
  • If you can read from the text box you can might as well read from the big on screen keyboard
  • With this, no need for confirm password

Please make life easier for users

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.