The password should have been shown after a POST request, not to a simple GET request. Put a button “click her to see password, you got one chance” to trigger

The password should have been shown after a POST request, not to a simple GET request. Put a button “click her to see password, you got one chance” to trigger the POST.