HTML Password Visibility Toggle with Accessible Button

A form should feel easy to use. The visitor sees a question, gives an answer, and needs to know what will happen next.

What You Need to Know

The script switches type between password and text, changes the visible button label, and updates the pressed state.

Try the Example

Take a look at the example. We’ll explain the important lines right below it.

<form action="/login" method="post">
    <label for="account-password">Password</label>
    <input id="account-password" name="password" type="password" autocomplete="current-password" required>
    <button id="toggle-visibility" type="button" aria-pressed="false">Show password</button>
    <button type="submit">Sign in</button>
</form>
<script>
    const passwordField = document.querySelector("#account-password");
    const visibilityButton = document.querySelector("#toggle-visibility");
    visibilityButton.addEventListener("click", () => {
        const isPasswordVisible = passwordField.type === "text";
        passwordField.type = isPasswordVisible ? "password" : "text";
        visibilityButton.textContent = isPasswordVisible ? "Show password" : "Hide password";
        visibilityButton.setAttribute("aria-pressed", String(!isPasswordVisible));
    });
</script>

Let’s Read the Code

<form>: The form groups controls and identifies where submitted data goes.
<label>: The label tells people what the input is for. A matching for/id pair makes the label clickable.
for: For connects a label or output with a control by ID.
id: An id uniquely identifies an element on this page.

Read the named elements and attributes together. They explain how the browser connects this feature to the rest of the page.

What Happens in the Browser?

When the form reaches a server, the server must check the information again. A nice-looking HTML field is not a security control.

What about privacy? A password input hides characters from people looking over your shoulder, but it is not encryption. A real application uses HTTPS, secure server logic, and careful handling of any private information. Do not put passwords into GET query strings.

Your Turn

Use the keyboard to reveal and hide the password, then check the button label at each step.

Common Beginner Mistakes

Copying the example without giving the fields a clear label and a usable name.
Showing the password exposes it to people nearby. The server still needs HTTPS and secure authentication.

Key Takeaways

Choose the HTML feature that explains this task clearly.
<form>: The form groups controls and identifies where submitted data goes.
Treat personal information carefully. The HTML example cannot replace HTTPS, server-side security checks, or safe storage.