Jacob Nielsen on his website published a call to stop masking the passwords in the forms. This means not authorization forms, but registration forms, where they usually ask to enter a password twice.
He cites 2 problems that arise when masking passwords in forms:
Users make more mistakes when entering passwords, as they do not see what they are entering, what makes them feel insecure, and some may feel freaked out and not recorded.
Users can enter a simpler password in order not to sweat with a “blind” input of a complex password, or use copy-paste. This reduces the security of their account.
If you think about it, it is really not clear why now use masking on the registration forms. The only reasonable reason is that someone in an Internet cafe can overlook the password entered. But it is so unlikely, and the Internet cafes themselves are already dying off. When there is a great need, Nielsen suggests adding a checkbox to the form to enable masking of the entered passwords. ')
Do not mask passwords anymore?