Unmasking the Security and Usability of Password Masking

Password masking, a practice where passwords are obscured during entry, is widely adopted for online authentication. However, its merits have been debated for over a decade, with questions about its security benefits and concerns about its usability impact. Yet to date, masking has received limited prior exploration. In this work, we empirically investigate the security and usability impact of password masking. We first assess the masking practices of popular browsers and websites, demonstrating masking's ubiquity as well as its design diversity. Guided by our real-world observations, we then conduct a mixed-method evaluation of masking for both mobile and PC devices, combining a survey of over 200 participants on their experiences with and perspectives on masking along with user experiments of 600 participants performing password logins under varying masking conditions. Through our study, we uncover misconceptions about masking, masking's usability and security impact, and user preferences on masking's use and its design. Ultimately, our study establishes empirical grounding on how this popular technique manifests in practice, providing recommendations for its use moving forward. CCS Concepts • Security and privacy → Usability in security and privacy; Authentication.