Add 'Show Password' Button for Password Fields During Password Change Process

[izabellaalves]

Is your proposal related to a problem?

While changing my password, I noticed that it's not possible to see the last letter I typed, which is common in password fields, and there's also no "show password" button.

Describe the solution you'd like

I would like a button next to the password-related fields where, upon clicking, the characters that were previously obscured can be seen, and upon clicking again, they become obscured.

Anyone can contribute to this. View our contributing guidelines, add a comment to the issue once you’re ready to start.

[gasman]

I noticed that it's not possible to see the last letter I typed, which is common in password fields

Are you sure about this? I've only ever seen this behaviour on mobile devices, and indeed Wagtail's password fields do work that way on mobile:

As far as I'm aware, this behaviour is always provided by the browser - it isn't something that Wagtail could implement on its own if the browser doesn't natively behave that way.

Happy to accept the feature request for a "show password" button, though.

[gasman]

Probably worth mentioning, there are known security issues with 'reveal password' features, since browsers treat them as plain text inputs while they're in the "visible" state, and may store or transmit that text insecurely for purposes like spellchecking and crash recovery:
https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/
https://www.halborn.com/disclosures/demonic-vulnerability

It seems there's also some disagreement between security auditors and accessibility advocates about whether password reveal is good practice or not...
https://www.reddit.com/r/sysadmin/comments/xlgplm/auditors_say_password_reveal_button_is_a_security/

[zerolab]

It is interesting to see that GDS has now an official password input component that does show/hide and it toggles beteewn <input type="password"/> and <input type="text"/>.

Similar security concerns were raised in alphagov/govuk-design-system-backlog#240 (which is the discussion for the new component)

[riaan-attar]

I had added the show password button the pull had been requested

[29deepanshutyagi]

i want to work on this issue , if this issue is still opens @gasman , i will solve this by implementing a button next to password-related fields that toggles the visibility of the password when clicked. The password characters will switch between being obscured () and visible ().

if any other approach is required to solve kindly gave me the details about that approach as well

[gasman]

Hi @29deepanshutyagi - thanks for your interest! There's an existing pull request for this issue at #11961, but it requires some extra work. If you're interested in picking this up, please see @lb-'s comment at #11961 (comment).

[29deepanshutyagi]

yes , i am willing to do that extra work and solve this issue completely

[lb-]

@29deepanshutyagi here's a good starting point for a Stimulus implementation of this feature. https://github.com/stimulus-components/stimulus-password-visibility/blob/master/src/index.ts

I'd recommend we add this capability to the the ActionController. Maybe we should have a seperate controller, see what feels right when building it out.

Also, a reminder that the issue is about the password field that's used when editing your account, not for the admin sign in form.

I would not suggest this feature for the sign in form, based on the discussion above. However, once have the ability to use this for the password change form we can explore other usage.