Show Password Fields

November 21st, 2007 by bill · 16 Comments

»Here is an updated javascript bookmarklet to display password field values in the clear.

 

Update: had a case-sensitive bug in the code. Fixed now.

A simple Javascript bookmarklet shows password field values.

In form fields where a password is entered, it is usually obscured by asterisks or bullets to prevent someone from seeing what you type. This is a great feature but where a long password is being typed or a remembered password is filled in by the browser, you might want to actually see the actual password itself.

Show Password Bookmarklet

Here is a bookmarklet (a snippet of Javascript that can be pasted into the address bar of your web browser), that will show any passwords on a page that contain password form fields.

javascript: (function() { var s="",F=document.forms,j,f,i;for (j=0; j<F.length; ++j) { f=F[j]; for (i=0; i<f.length; ++i) { if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n"; } } if (s) alert("Password fields:\n\n" + s); else alert("No password fields on this page."); } )();

Just paste the above javascript into the address bar of your browser and press Enter, or create a bookmarklet link with the javascript as the URL. On this page you’ll see the password for the mock sign on form below.

User Name: Password:

This is nothing new.

This or similar javascript has been around for a while. This particular one was on raymond.cc (via etc.), but it needed to be fixed for some forms where fields have a null type property (an example is the sign on form for LinkedIn). The fix was adding f[i].type && to the if statement inside the inner for loop.

Formatted Javascript Code

If you’re interested in what is happening to make this work the formatted code is below.

Essentially, the variable F is set to the collection of forms on the page, which is looped through, examining every input field in each form testing if it’s of type “password.” If it is a “password” field, its value is appended to the string variable s. Once all the input fields in all the forms on the page have been sniffed, the string value is displayed in an alert.

javascript:
(function() {
  var s="", F=document.forms,j,f,i;
  for (j=0; j<F.length; ++j) {
      f = F[j];
      for (i=0; i<f.length; ++i) {
          if (f[i].type.toLowerCase() == "password") s += f[i].value + "\n";
        }
    }
  if (s) alert("Password fields:\n\n" + s);
  else alert("No password fields on this page.");
}
)();

But Firefox already…

And yes, we know Firefox will show you passwords in the clear with Tools/Options/Security/Show Passwords.

This javascript, however, is easier to access if you have created a bookmarklet for it, plus it works in other browsers.

Tags: Javascript · Programming · Security

 

16 responses so far ↓

  • 1 aksn1p3r // Nov 21, 2007 at 1:21 pm

    Nice modifications and workarounds!

  • 2 Beth Arrington // Nov 29, 2007 at 10:29 am

    nice i love firefox!!!!

  • 3 Duke // Mar 24, 2008 at 5:35 pm

    try this code below. In this code it doesn’t popup the password but reveals the password there and there itself.

    javascript:var els = document.getElementsByTagName(‘input’); for(var x=0; x<els.length; x++){ if(els[x].type.toLowerCase() == ‘password’ ){ var test = els[x].type = ‘text’;}}

  • 4 bill // Mar 25, 2008 at 6:38 pm

    @Duke – yes, that works too.

  • 5 yashu // Oct 26, 2008 at 1:04 am

    actuallu i forgot the password written in my yahoomessenger.
    any tips to view that password

  • 6 Allan Kelly // Oct 12, 2009 at 3:20 pm

    Thanks, but your code doesn’t work. Your 1st loop should be on ;j<F.length; – not on ;j<f.length; as you have published (twice) above.

    With that fixed it works.

    Cheers, al.

  • 7 LOLA // Aug 11, 2010 at 6:55 pm

    Their smiley face dudes are okay but i wanna see cooler dudes! :p Please find some new ones!

    MOOD: anxious!!!!!

  • 8 gopinath // Jan 12, 2011 at 2:50 am

    • javascript:var els = document.getElementsByTagName(‘input’);for(var x = 0; x < els.length; x++) {if(els[x].type.toLowerCase() == 'password' ) {var test = els[x].type = 'text';}}

  • 9 ashish // Jan 25, 2011 at 12:20 pm

    When i work with this code,i dont find my desired result,so plz give me idea about how to use this code for see password

  • 10 3bdullelah // Feb 24, 2011 at 8:36 am

    Its easy ex: if you want to login in facebook , write your email and password, then copy the JavaScript code and paste into the address bar of your browser and press Enter. “Just that”>> as he say

    Q: What is the useful from that?

  • 11 muhammad // Jun 9, 2011 at 6:36 am

    javascript:
    (function() {
    var s=””, F=document.forms,j,f,i;
    for(j=0; j<f.length; ++j) {
    f = F[j];
    for (i=0; i< f.length; ++i) {
    if(f[i].type && f[i].type.toLowerCase() == "password")
    s += f[i].value + "\n";
    }
    }
    if (s)
    alert("Password fields:\n\n" + s);
    else
    alert("No password fields on this hotmail.");
    }
    )();

  • 12 jon // Aug 22, 2011 at 1:50 pm

    can,t work,,,,,plese help me…when i enter theis java script..then show password field……………..,,can,t show password,,,,,how can i do..

  • 13 rebeen // Aug 27, 2011 at 1:54 pm

    i forget my password

    facebook

  • 14 arun // Aug 31, 2011 at 8:45 pm

    it’s not working anymore

  • 15 bob // Dec 1, 2011 at 6:42 pm

    can’t find my pass word.

  • 16 bob // Dec 1, 2011 at 6:45 pm

    had it formatted and cant get my gmail back

Leave a Comment


7 − three =