Asterisk field

When you log in somewhere, you usually enter two things. Your name or your email address is displayed normally on the screen. With the password, however, only dots or asterisks appear, one for each letter typed. This is exactly what is called an asterisk field. It hides the input from prying eyes while you type. The computer itself, of course, still knows the real characters, it just doesn’t display them.

Protection against looking over the shoulder

The asterisk field solves a very old-fashioned problem: someone standing next to you and looking at your screen. Experts call this shoulder surfing. In an open-plan office, on a train, or in a classroom, this is not a rare occurrence. Anyone who has once read off a password needs no technical knowledge whatsoever to cause damage with it.

What’s important, however, is what the asterisk field does not do. It does not protect against someone intercepting the data on its way through the internet. That is the job of the encrypted connection, recognizable by the “https” in the address bar. Nor does it protect against malware that records every keystroke. The asterisk field is a measure against onlookers in the room, nothing more.

Experts have been arguing for years about whether it even still makes sense. The well-known usability researcher Jakob Nielsen called for the masking to be abolished as early as 2009. His argument: people mistype, don’t see the error, and therefore choose shorter, worse passwords. The compromise that has become established is a small eye icon for revealing the text.

What happens behind the dots

Technically, an asterisk field is astonishingly simple. In the language used to build websites, there is a field type called “password”. If a developer sets this type, the browser automatically replaces every character entered with a dot. The text remains unchanged in the background and is transmitted in full when submitted.

A common misconception is that the field encrypts the password. It does not. It only visually hides the characters, like a privacy screen in front of a window. The actual security arises later: a reputable provider never stores your password in plain text, but instead converts it into an irreversible string of characters. This process is called hashing.

The operating system also helps. It usually hides asterisk fields from automatic screen recordings and prevents translation tools or spell checkers from reading the content. On smartphones, the typed letter often appears for about a second before turning into a dot. This is a deliberate compromise between security and the fact that typos are common on small keyboards.

From the login form to the chatbot input

You encounter asterisk fields everywhere you identify yourself: with your school account, with online banking, with streaming services. The PIN screen at the ATM also works on the same principle. Password managers, i.e. programs for managing many login credentials, also use them and then fill in the fields themselves.

In the world of AI, the term has taken on a new meaning. Anyone who wants to connect an application to a language model needs an API key for this. This is a long string of characters that functions like a password and is used to bill access. Such keys are also entered into asterisk fields in developer portals so that they don’t end up in screenshots or screen recordings.

A clear warning sign, incidentally, is a missing asterisk field. If a website can show you your old password in plain text, it has stored it unencrypted. In the event of a breach of the database, all login credentials would then be exposed. Reputable services therefore only offer a reset, never a display of the old password.