Masking raises the typing-error rate
Aliases: masked password · password bullets · unseen keystrokes
What it is
A password field replaces each character with a bullet or asterisk, so people cannot see the key they just typed. Password masking raises the cost of shoulder surfing and, at the same time, cuts visual proofreading: extra letters, missing letters, and a stuck caps lock wait until submit fails. Password masking error cost is that claim: the same string, unseen, is typed wrong more often than when seen. It does not discuss whether an eye button sits beside the field, and it does not discuss paste.
Why it happens
Ordinary text proofreads against glyphs in the slot: an extra letter or a wrong mark can be caught by the eyes. Masking removes the glyphs; the remaining channels are motor memory in the fingers and, sometimes, key-click sound. Passwords also encourage high entropy, mixed case, and embedded symbols—the strings motor memory is worst at. Errors are deferred until the whole string is submitted; people cannot tell which position failed and retype the lot, still blind. Shoulder-surfing protection is real, but it protects “the person beside you” at the price of “you cannot see either”; in a private setting the second cost is often larger.
Studying it
Have the same people enter the same passwords (or their own) under masked and clear conditions; record pre-submit accuracy, backspaces, retries, and time. Nielsen’s critique of masked passwords, and later usability experiments, take error and retry as the core outcomes, not a safety self-report. Factors: length and complexity, a briefly revealed last character, whether someone sits nearby. Shoulder surfing can be a separate task: leak rate of clear text with a neighbor. Do not replace “was it typed right” with “I feel safer”; a rise in felt safety with a failed login is the cost being shifted.
Where it stops holding
In public, with someone behind, the shoulder-surfing benefit can outweigh the error cost, especially on a projector or shared screen. On mobile, thumbs miss more keys, so the error cost is larger than on a desktop. One-time codes and unlock patterns are not password masking; do not mix them into the same measurement. Revealing only the last character restores some proofreading, but the rest of the string stays hidden, so the error drop is limited. Screen readers will speak a clear password aloud; revealing text in public opens another leak.
Applying it
- Treat masking as a switchable protection, not as an undiscussed default; keep a ledger in error rate and retries.
- When login fails and the field is still bullets, assume a typing error before assuming the person forgot the password.
- On a private device with no bystanders, prioritize being able to proofread the string just typed.
- Verify by having people type a slightly long new password under masking and submit. High retries and whole-string deletes mean the proofreading channel was cut. Compare error counts for the same string in the clear.