如果输入了错误的凭据，则防止清除密码字段

Question

I have noticed on some sites that, when we enter the wrong credentials the password fields becomes encrypted instead of clearing, mean if user enters password *** it will becomes like ********** and password fields doesn't cleared, what is the technique they are using, I am looking for below solution, but didn't find out relevant info:

1. Prevent browser to clear the password field if wrong credentials.

2. Encrypt the password before submitting to server in simple JS, and decrypt in server side(I am using JSF), and if wrong credentials the encrypted password should be displayed in field

Answer 1

They are likely just putting the word "password" in the value. As for sending it secure I suggest using SSL. SSL is designed for this thing exactly. It encrypts the entire webpage and all post data.

If they enter an incorrect value it is best to clear the password field. You can leave the username/email but should clear the password field. This is just standard security practice.