According to Jakob Nielsen, “usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn’t even increase security, but it does cost you business due to login failures”. He suggests that passwords should be shown in plain text and masked only if the user chooses to do that by using a checkbox. Nielson also states that users make more errors when they can’t see what they’re typing while filling in a form and they are feeling less confident. Perhaps, for this reason Apple implemented an alternative method on IPhone/IPod touch: the passwords are masked when the users type them, except the last character.

Stefan Ullrich, created a JQuery Plugin that converts the last character of a masked password field into a plain text one. The effect is the same as the one from the IPhone/IPod touches.

Features include:

• The script is unobtrusive; Non-JS users get the common masked password fields
• Supports copy & paste
• No HTML modification is required as finds the password fields by type
• Options: interval, delay, replacement character, prefix, debug mode (requires FireBug enabled)