2

I have this code for input with type="password"

<input
  type="password"
  id="password"
  value={form.password}
  onChange={handlePasswordChange}
/>

It works, but I noticed, that in develeopers console "Elements"you can actually see value of password field:

<input type="password" class="form-control undefined" value="qwerty">

Is it ok, that it shows password like this? Is there a way to hide it? Should i use uncontrolled componenets instead of controlled?

2
  • As long as you're not setting the value to an actual password, all the user would be able to see is the value they've entered. Commented Sep 3, 2021 at 10:40
  • That's good question. Even in the Google SignUp we can see that. Since you use this feature whenever user fills up the form him/her-self this is not a problem. Commented Sep 3, 2021 at 10:56

1 Answer 1

6

type="password" only cosmetically hides the password. The input value is always accessible via JS (using it's .value property). So when someone opens DevTools, he or she will be able to get the password regardless.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.