How to mask Password in MVC ViewRazor

Question

I need to mask Password in View in MVC Project, where i have list of users.

Model:

 [Required]
        [StringLength(50)]
        [DataType(DataType.Password)]
        [DisplayName("Password")]
        public string Password { get; set; }

I have this code in View, where i see the Passwords at the moment.

 @Html.DisplayFor(modelItem => item.Password)

How to Mask password in View?

EDIT:

If i try with @Html.PasswordFor(modelItem => item.Password) i see this:

Image1

I think there's `PasswordFor`. If so change it for `DisplayFor`. — dcg, Apr 12 '17 at 18:58
I tried it, but if i put PasswordFor i get TextBox for the password field. — Mister XP, Apr 12 '17 at 18:59
@Steve - This is not DUPLICATED Question, because i not need to show PasswordType in Editor, i need to show PasswordType in View. — Mister XP, Apr 12 '17 at 19:13
Yes of course, i edited again the question, and add-ed model code. — Mister XP, Apr 12 '17 at 19:20
What exactly are you intending to display here? The actual text of their password, or just a series of dots indicating that they have one? — BThompson, Apr 12 '17 at 19:33
i need to show number of letters or numbers but with stars. ex. if password is 12345 replace with ***** — Mister XP, Apr 12 '17 at 19:37

score 8 · Accepted Answer · answered Apr 12 '17 at 19:43

8

If I understand correctly what you're trying to do, I recommend an entirely different approach. Really, there's no reason to display the correct number of dots corresponding to the number of characters in their password. Doing so is a security hole; it tells attackers that they only need to try passwords of a given length. In fact, you should not be storing passwords in plaintext to begin with, so you shouldn't know how many characters there are

All that said, I recommend using

@Html.Raw("\u2022\u2022\u2022\u2022\u2022")

The string "\u2022" refers to a unicode character for a black dot, so this will simply display 5 black dots on the line

answered Apr 12 '17 at 19:43

BThompson

350
2
14

yes you understand me well. this is corect and usable answer. thank you – Mister XP Apr 12 '17 at 19:47
Glad I could help. FYI, directly storing the value of a password is generally a Bad Idea. If an attacker gains access to your database, they can immediately access your site and cause mayhem by posing as any of your users. Furthermore, if your users use the same password for other sites (which they almost always do), their accounts on those other websites could be compromised as well. [Here's an overview](http://stackoverflow.com/questions/4181198/how-to-hash-a-password/10402129#10402129) of how to do password hashing – BThompson Apr 12 '17 at 19:56
And [here's](https://security.stackexchange.com/questions/36833/why-should-i-hash-passwords) a quick run through of why password hashing is so important – BThompson Apr 12 '17 at 20:00
Great answer, but it then begs the question of what's the point of displaying the password at all if it's always 5 black dots. That's more a question for the OP, though. About the only thing this buys you is that you will be able to potentially see if no password has been set (null), which may not even be a possibility in the first place (i.e. password may be required). If it's required then there's no point in displaying the "password" at all. If it isn't required, it would then probably be better to just display a boolean indicating whether a password is set or not. – Chris Pratt Apr 12 '17 at 20:09
I think is ok, because 1. Null password is not allowed, it`s requred in the registration, and not possible to be null, . 5 dots not change nothis is password is with diferent then 5 Latters or Numbers. and 3. I need this in administrator page for better look in list, and also is possible to delete table column and no problem again will not see the password. Thank you Again to all. – Mister XP Apr 13 '17 at 08:26

score 4 · Answer 2 · answered Apr 12 '17 at 19:00

4

@Html.PasswordFor(modelItem => item.Password)

Try this

answered Apr 12 '17 at 19:00

LiverpoolOwen

806
2
10
25

1

i tried with this but i get just TextBox editor **@Html.PasswordFor(modelItem => item.Password)** – Mister XP Apr 12 '17 at 19:02
1

You sure? Try a rebuild and hard refresh in the browser – LiverpoolOwen Apr 12 '17 at 19:03

score 0 · Answer 3 · answered Jul 19 '18 at 12:08

To create complete form which is suitable for data type attributes in model class you can use following statement:

@Html.EditorForModel()

This method is generating code for each property of model class, which is equivalent to following:

@Html.LabelFor(model => model.Name)
@Html.TextBoxFor(model => model.Name)

How to mask Password in MVC ViewRazor

3 Answers3