views:

366

answers:

3

I have a usual login form consisting of two input fields, one for login, one for password. I am currently trying to add a control that will show entered password as plain text, so user can check it for typos.

The problem is that browsers (at least Firefox) do not allow dynamic changing of type attribute of input fields, so I cannot just change type="password" to type="text". Another problem is that browsers do not allow to get value of password field, so I can't create a new input type="text" and set its value to the password's one. I've seen several different approaches to this task, including this one, but they are working only if the password is typed and fail when browser autofills the password.

So, any suggestions to do this are welcome. I am using jQuery.

A: 

If I may, I don't think it's a great idea to show the password in text, for the following reasons:

  1. It's not commonly done, so it will be confusing to the user
  2. It means you are open to over-the-shoulder viewing of the password

I also think, if you just want to help users avoid typos, give them more chances before the password is disabled. I think the typical "3" that most sites implement is not really required, I'd suggest "10" attempts, or perhaps "5", if you wish to be really conservative, is quite acceptable. Just count it down for them, and let them resolve typos on their own.

Just my humble opinion.

Noon Silk
By default the password is hidden, of course. If user is clicking the link labeled "Show me the letters what I just typed into that password field because I am not sure that I typed them right", chances are high that he understands what he is doing and he knows what will happen next :)
n1313
Even still, it feels wrong to me. Each to his own though.
Noon Silk
Even programs where security is very important like TrueCrypt and password safe have features for enabling the password to be shown. Especailly in situations where the user could be using a very long or complex password/passphrase, being able to see the password can be a very good feature. I agree with N1313 that the person clicking on it would must likely check for shoulder surfers before clicking on the button to reveal the password.
Kibbee
Kibbee: I don't disagree. Each to his own.
Noon Silk
Instead of limiting the number of responses, you could add a sleep for 2-3 seconds before responding that the password is wrong. It's a very tolerable wait for a human, but it greatly reduces the efficiency of any attempts to brute force the password.
Guffa
+2  A: 

You can do something like this:

<input type="password" id="password">
<input type="checkbox" onchange="document.getElementById('password').type = this.checked ? 'text' : 'password'"> Show password
Gumbo
It works! Unbelievable. It seems that my problem was in jQuery that I am using. By some reason it did not allow me to do this trick.
n1313
this will most likely not work correctly in IE
code_burgar
More than likely. I have confirmed that it doesn't work at all in IE.
Guffa
+1  A: 

I have never tried this myself but can't you just access the value property of the element?

if you have something like...

<input id="pw" name="pw" type="password" />

Then in JavaScript / jQuery...

var pass = document.getElementById('pw').value;

$('pw').val()
Fraser
See: http://www.w3schools.com/htmldom/dom_obj_password.asp
Fraser
Wait, what. I am pretty sure that I tried this before posting the question and it didn't work out, but now it does. WTF. Needs more checking!
n1313