Protecting against input type ="password" changes? [closed]

Question

Are there any protections against users using Chrome Developer Tools to right click on a password input field, and then change input type="pass" to "text" to reveal the password?

There are probably JavaScript ways but once again that is extremely easy to disable.

Any improvement is better than what we have now, as the trick is too commonly known.

Answer 1

Well, you can do it using the MutationObserver API.

const inputPasswordElements = document.querySelectorAll('input[type=password]');
const observer = new MutationObserver(function (mutations) {
    mutations.forEach(function (mutation) {
        if (mutation.type === 'attributes' && mutation.attributeName === 'type') {
            mutation.target.value = '';
        }
    });
});
Array.from(inputPasswordElements).forEach(function (input) {
    observer.observe(input, {attributes: true});
});

This will remove the password if the input type is changed. Demo available here.

But why would you do that? The user can read the password in the source anyway, so that won't prevent him to do so.

Also, please note that allowing the user to see his password in a clear-text format is quite common now, to allow him to check for typos before submitting a form. If your website doesn't allow this option, it's very likely that users will check in the source themselves.

Do not be hostile with your users, please. Help them instead.