My main issue with this solution is that it takes the decision out of the user's hands. Granted, in some cases it is potentially beneficial to unmask the passw

My main issue with this solution is that it takes the decision out of the user's hands. Granted, in some cases it is potentially beneficial to unmask the password, but I would not want a site to assume that I'm okay with this approach. Imagine if you have to type in a password presenting in front of a crowd of 100 people. Do you feel secure with this solution? Whatever solution you implement, it's important to give the user explicit control to override the mask.