Screenshot attached.

Hi Kapil India, is that in a built-in dialog, or on the Firefox Account sign in page --

https://accounts.firefox.com/signin

-- or on some other web page?

That might be a feature on a specific website. The Firefox source code only has this reveal icon on the about:logins page and that icon look slightly different.

• chrome://browser/content/aboutlogins/icons/show-password.svg
• https://dxr.mozilla.org/mozilla-release/source/browser/components/aboutlogins/content/components/login-item.css

cor-el said

That might be a feature on a specific website. The Firefox source code only has this reveal icon on the about:logins page and that icon look slightly different.

• chrome://browser/content/aboutlogins/icons/show-password.svg
• https://dxr.mozilla.org/mozilla-release/source/browser/components/aboutlogins/content/components/login-item.css

Yes you are right it is website specific , like now days Gmail/Yahoo and other website have. How I can disable it , as it is creating privacy issue for saved password. But also it is not asking for master password before revealing that. Kindly help on same.

Any one please help me for above issue ?

Hi Kapil India, let's split this into two parts:

(1) What scenarios are you trying to protect against?

The masking of the password input is to prevent a passerby from seeing your password on the screen. That is pretty much all it is good for. If someone has hands on your keyboard, they can get the password.

If you think someone might start your Firefox and scrape an auto-filled login, the way to prevent that is to set a local Master Password which needs to be entered before Firefox will allow using saved logins. See: Use a Primary Password to protect stored logins and passwords.

Note: once you have entered the Master Password, saved logins are unlocked for the rest of your session. To lock them again, you have to cancel a new Master Password dialog. One way to do that is to open the Lockwise page and click a Show Password button or Copy button there, because that will prompt you to re-enter the Master Password. If you cancel, saved logins are re-locked.

(2) Disabling the "eye" button in web pages

These buttons typically run a script that changes the password field from type="password" -- which browsers mask with disc characters -- to type="text" -- which browsers do not mask. I am attaching a screenshot illustrating this on Google's sign-in page.

Script & Style Hack

If you were using the page in Chrome or Safari, you would have a CSS property to "mask" characters in text inputs:

https://developer.mozilla.org/docs/Web/CSS/-webkit-text-security

Firefox doesn't support that property natively; I don't know whether there are any code libraries for this or whether you need to come up with a solution from scratch.

Anyway, let's imagine you have that style property available through one means or another. (I was an economics major.) Then, what you could do is set up a MutationObserver to watch the code of the page for input type="password" and add a new attribute such as alwaysmask="true" to each one. Then finally you would inject a style rule like this:

input[type="text"][alwaysmask="true"] {
  -webkit-text-security: disc;
}

With that in place, wwhen the "Show Password" button is clicked, there would be no visible change to the user.

Attached is a screenshot (from Chrome) of how the mask would look when the two parts are in place: custom attribute and custom style rule.

Other Discussions

I ran a search and found some threads but haven't studied them:

• https://stackoverflow.com/questions/17017124/security-issue-of-changing-type-password-into-type-text
• https://security.stackexchange.com/questions/186919/protecting-against-input-type-password-changes
• https://stackoverflow.com/questions/12012798/how-to-prevent-a-user-from-getting-password-field-value-in-console

Hello Kapil India,

In addition to the above you may be interested in these tutorials about how to disable the eye symbol (password reveal button) in Windows 10 :

https://www.isumsoft.com/windows-10/disable-password-reveal-button.html

https://www.4winkey.com/windows-10/how-to-disable-password-reveal-button-in-windows-10.html

https://winaero.com/blog/disable-password-reveal-button-in-windows-10/

Yes I have this issue:

2) Disabling the "eye" button in web pages

These buttons typically run a script that changes the password field from type="password" -- which browsers mask with disc characters -- to type="text" -- which browsers do not mask................................

See below example of https://www.linkedin.com/ you can see in password there is option of show/hide, i want to disable that for security reason. I have custom firefox browser from source code.

On websites like Linkedin, Gmail etc., the "Show/Hide" button and the eye symbol only show on the login page. The mere purpose of that button/symbol is to let you check to see if you have entered the correct password. Only you will see it; no-one else (after all : only you can see your login - when someone else wants to login to those sites, they will get their own login pages).

I am filling that password with someone via teamviewer I don't want that person can see my password while login as it is official and he have to use that only for work. Any help is appreciable as it is really a issue for this type of work.

Kapil India said

I am filling that password with someone via teamviewer I don't want that person can see my password while login as it is official and he have to use that only for work. Any help is appreciable as it is really a issue for this type of work.

If that person would click that button/symbol to see your password, you would see what he/she does and immediately report them to TeamViewer ! (you'll see their ID on your screen)

It would be a shame though, if you couldn't even trust a TeamViewer employee, someone who's supposed to be helping you .....

Would it be possible for you to have a relative or a friend help you via TeamViewer instead of a stranger ?

If there is a small number of websites where you want to hide the buttons, and the change is only needed on your Firefox, you could use custom style rules to hide the buttons. For example, for LinkedIn:

@-moz-document domain("linkedin.com") {
    /* Hide "eye" icon in password field */
    .sign-in-form__password-visibility-toggle {
        display: none !important;
    }
}

Each site will need its own rule, so this approach requires knowing what sites you will be logging in on.

To set that up in Stylus

First you would need to install the Stylus extension:

https://addons.mozilla.org/firefox/addon/styl-us/

After installation, click its "S" toolbar button, then the Manage button to open its main page.

Then click the "Write new style" button.

Stylus will highlight the name field, and you can name it whatever is helpful, such as LinkedIn: No Show Password.

On the right side, click in the code box and paste the above code. Stylus will pop up an overlay titled "Paste the Mozilla-format code". Click the "Overwrite Style" button to insert it into the code box.

Click the Save button below the style name and test LinkedIn -- you might need to reload (Ctrl+r) that page.

Success?

To discover a selector to use to hide buttons on other sites, you can use the Page Inspector: https://developer.mozilla.org/docs/Tools/Page_Inspector

Note that you can right-click the Show/Hide button to inspect its selector in the Inspector.

• "3-bar" menu button or Tools -> Web Developer
• https://developer.mozilla.org/en-US/Tools/Page_Inspector/How_to/Examine_and_edit_HTML