I'm not willing to concede his point yet, but even if he's right, this should be implemented by the browser, not the website. And if you consider taking his adv

I'm not willing to concede his point yet, but even if he's right, this should be implemented by the browser, not the website. And if you consider taking his advice, I suggest masking the password as soon as the input field loses focus.