A show/hide control should be present by default
Aliases: show password · eye icon · unmask toggle
What it is
Whether to see the password being typed should be a choice in the moment, not a one-time decision the product makes for every setting. A password reveal control is an explicit control on the field that swaps bullets and clear text in the user’s hands. Without it, a private setting still cannot proofread, and a public setting cannot cover the string quickly. The issue is whether control sits with the user, not whether masking itself raises errors, and not whether paste is allowed.
Why it happens
The payoff of masking versus clear text flips with the setting: at home you need to see; in a café you need to cover. Putting the choice on the field makes the switch one click, tuned to current shoulder-surfing risk. If the only path is an OS-level “show password,” or there is no path, a change of setting means retyping the whole string or accepting blind typing. The control must also be discoverable and exposed to assistive tech as show/hide, or it might as well be absent. Press-and-hold reveal suits a quick glance, not checking a whole string; click-to-toggle holds state and suits fixing a character. The two pressings serve different checking durations.
Where it stops holding
When enterprise policy forbids clear text, the control collides with compliance; that fight belongs at policy, not as a widget that pretends to work. A system “show” above the mobile keyboard plus an in-field button can disagree, and people think the field is broken. For a public demo or a projected screen, default to masked, but keep the control; do not delete it because of demo risk. Screen-reader users who reveal will hear the password spoken; the accessible name must say that.
Applying it
- Put a discoverable show/hide on every password field, masked by default, staying clear after a click until a second click or blur (pick one by risk, but make it predictable).
- Name the control “Show password / Hide password”; do not ship an unlabeled eye.
- Make the switch change visibility only—not the value already typed, and not emptying the slot.
- Verify by revealing in a private setting to fix one character, then covering when someone walks by. If the button cannot be found, a click clears the slot, or a screen reader never hears the control, reveal is not yet a capability.