"Show password" button overlaps with the LastPass icon

[SergeyBiryukov]

The new "Show password" button added to login screen in [46256] overlaps with the LastPass extension icon. Tested with Google Chrome 77 on Windows 10.

This only happens on Log In and Reset Password screens. The Edit User screen is OK, as the button there is separate from the input.

[sabernhardt]

moves button from the (right) edge when input has background-image in style

[sabernhardt]

login form after patch

[sabernhardt]

The patch checks for a background image in the password input's style attribute. If it finds one, the show password button moves over by 40 pixels.

[johnbillion]

How do services that use the "show" button such as Facebook, Google, and WordPress.com handle this?

[adamsilverstein]

google sign in

[adamsilverstein]

Attaching some screenshots of the Google account login screen.

Here, the show password icon looks like it is in the right hand edge of the input - in fact, its outside the input entirely and uses a merged borderless edge to make it appear as part of the field.

[adamsilverstein]

One other potential option would be to disable the lastpass icon for the password field by adding data-lpignore="true". I verified this works and that I can still fill in both fields using the icon visible in the user_name field.

[adamsilverstein]

login with data-lpignore="true" in password field

[adamsilverstein]

data-lpignore="true" approach

[sabernhardt]

I tested the second patch in Edge, IE11, Opera 63, Firefox 69 and Chrome 77 on Windows 10. I had no trouble populating the two fields with LastPass when clicking the icon inside the Username/Email input or when using the show/hide button. It looks cleaner than my option, and I'm not sure having a clickable LastPass icon in the Password field is necessary after the previous field.

[Clorith]

LastPass being just one of many password managers, I would be more inclined to take the route of the other big players out there; a "fake" part of the input with no left border as noted in comment:4 would be more forward-compatible as well with whatever new services may pop up.

[garrett-eclipse]

I would also agree with the fake portion of the input. OR moving the icon up beside the 'Password' label so it's not directly in the input itself.

[davidbaumwald]

I agree with the "faking" of an extended input as well, instead of chasing an unknown number of vendor-specific workarounds.

[sabernhardt]

simplest option: only adding min-width to password input

[sabernhardt]

simplest option in Firefox (min-width)

[sabernhardt]

"fake input" option with border on container and larger input areas for login

[sabernhardt]

"fake input" option in Edge, with LastPass icons

[sabernhardt]

I included a simpler option of only the min-width because that should not require much testing.

For the "fake input" option, I tested in various PC browsers as well as at different zoom levels and with a larger text size. That still leaves plenty of other testing (including High Contrast Mode).

[afercia]

For the records, this was noted also on the Show Password ticket. See:
https://core.trac.wordpress.org/ticket/42888#comment:24
https://core.trac.wordpress.org/ticket/42888#comment:45

That said, I'm not sure WordPress should necessarily remediate to poor implementations by external software. It appears to me Lastpass should make a better job and take padding into consideration. I'd lean towards reporting upstream.

[davidbaumwald]

With 5.3 RC1 releasing today, this is being moved to Future Release. If any committer feels this can be worked in quickly for 5.3 or can assume ownership in 5.4, feel free to move it back up.

[afercia]

@johnbillion what are your thoughts on reporting upstream to LastPass? Seems to me LastPass should do a better job and its icon placement seems arguable. It also conflicts with native browsers UI. See for example Safari in th screenshot below. I think this also applies to Edge.

[afercia]

See the Safari "key" icon on the username field.

[johnbillion]

Observation: google.com and facebook.com both place the view button outside of the input (with a fake focus border). wordpress.com uses the padding method that core is using.

[SergeyBiryukov]

Related: #48392

[audrasjb]

Hi,

48222.4.diff is a nice workaround, but I'm wondering about implementating a fake input since focus outline looks very strange to me… and this will be the rendering for all users, even those who don't use LastPass or so.

Adding needs-design/needs-design-feedback workflow keyword and moving it to 5.4 as it doesn't sounds realistic for 5.3.1 which is planned this week.

[sabernhardt]

Yes, the fake input option could be better, so I agree to reconsider this for a later version. And it looks stranger in High Contrast Mode. Wrapping the username input with a similar container div might be a good start to improving it, though I'm not sure how yet.

Another consideration: the icon for Norton's Password Manager also overlaps.

[valentinbora]

Test of the login form with patch 48222.4.diff on Chrome/LastPass

[fahimmurshed]

Hi,

I have checked that, this issue is not solved yet.

I have modified this file /wp-admin/css/login.min.css

Change the padding

    padding: 0px 45px;

CSS code:

.login .button.wp-hide-pw {
    background: 0 0;
    border: 1px solid transparent;
    box-shadow: none;
    font-size: 14px;
    line-height: 2;
    width: 2.5rem;
    height: 2.5rem;
    min-width: 40px;
    min-height: 40px;
    margin: 0;
    padding: 0px 45px;
    position: absolute;
    right: 0;
    top: 0;
}

It should look like this

[xkon]

Usually any additional icons are added as a background image from extensions from what I've seen in general.

In a similar way to one of @sabernhardt early patches and the later of @fahimmurshed , instead of moving the eye icon we can force any background image to a different position.

As an example an addition like this to login.css would push the LastPass icon further on the left side instead.:

.login input#user_pass {
	background-position: 85% !important;
}

This is a simple solution imho that doesn't change the current input in any way and also avoids the confusion of the focused element not being in "full width".

[sabernhardt]

@fahimmurshed and @xkon: I like the idea of a simpler option. Unfortunately, moving the LastPass background image does not change the clickable area's position (behind the show/hide eye button). And the clickable area would be covered by the button with an increased padding, too.

I considered a right margin instead of padding, but then the eye button would cover the long passwords WordPress suggests (the first patch here has the same problem).

[afercia]

It's a bit unfortunate LastPass doesn't add anything to reliably target with CSS the fields it applies a background image to. the only option would be something like:

.login input[type="password"][style^="background-image"] { ... }

which is a bit crazy. Still thinking that LastPass should do a better job and the issue should be fixed upstream.

[garrett-eclipse]

Move the eye outside of the input

[garrett-eclipse]

Random thought, could we just move the eye outside of the input to avoid the conflict all together?

[valentinbora]

Some more layout ideas so we have options to choose from

[karmatosed]

Of any of these, the 2nd one would be my preference showing the eye and 'show password' underneath.

[fahimmurshed]

Both are awesome

[afercia]

Replying to karmatosed:

Of any of these, the 2nd one would be my preference showing the eye and 'show password' underneath.

I'd agree. I'd just consider to make the clickable area a bit bigger.

@karmatosed would you prefer to further discuss with the design team or can the needs-design and needs-design-feedback keywords be removed?

[karmatosed]

I would like to see it in a PR before totally looping design out of this. Let's remove the needs-design and keep design feedback keyword.

[valentinbora]

@karmatosed looking back at it after a couple of days rest, does the link need to have such high contrast (i.e. be so prominent)? I'd personally vote for turning it down a notch. Thoughts?

[nrqsnchz]

I think that @valentinbora's mockups are great. I particularly like these two (option 1 and 2):

The label "Show password" is more obvious, easier to understand than just the icon.

I'm also more inclined to the first version, where the label is above the field. In my opinion it is easier to see.

looking back at it after a couple of days rest, does the link need to have such high contrast

@valentinbora I think the contrast is fine.

[karmatosed]

I agree the contrast is fine for me. I think it would be great to get this into trunk and see what we think there. Thanks, everyone for the great work involved so far.

[paaljoachim]

I think the above option 1 in Enrique's post where the show password (I think both words need to begin with capital letters) is on the same line as Password bring better symmetry and balance in the overall image. The eye moves along the top border line from Password over to Show Password.

Option 2. Brings a stronger contrast where the eye needs to move from the Password text then down right across the password box to the show password.

Option 1 is easier on the eyes.

[valentinbora]

Desktop alignment and sizing of latest design with button in line with Password label

[valentinbora]

Reset password screen alignment and sizing of latest design with button in line with Password label

[valentinbora]

Implementation redone based on design feedback, button above field in line with label

[Clorith]

I'm not a fan of the markup here, to reach the button to toggle visibility one would then have to navigate backwards, and would also be exposed to a potentially contextless "Show" before even being presented with the input.

The toggle button needs its old label of Show password, we don't know what direction the user reaches the button, so retaining the context within the label is important.

The button should also be moved to come after the input form, you can still use CSS for positioning, but markup needs to follow a natural pattern.

[valentinbora]

@Clorith there seems to be some divergence between your feedback and #design (@melchoyce recommended the shorter label due to potential i18n constraints with longer verbiage in some languages). Please refer to ​https://wordpress.slack.com/archives/C02S78ZAL/p1581966078468900

Also, @nrqsnchz commented (see Slack link above) re. a11y for the button to be right after the label for context.

@Clorith please help out for reaching consensus here, then we can tune the code accordingly.

[afercia]

Replying to Clorith:

I'm not a fan of the markup here, to reach the button to toggle visibility one would then have to navigate backwards, and would also be exposed to a potentially contextless "Show" before even being presented with the input.

I agree with @Clorith.
UI controls need to make sense also when read out of context. A contextless "Show" would be the equivalent of a "Read more" link that doesn't specify the "what".

Re: the order: many users experience the content in a linearized way. Keyboard users, screen reader users, etc. The order of elements needs to be logical: first the "what", and then the actions related to the "what" object.

The option 2 on comment:34 is the only one that satisfies these needs.

Also, looking at 48222.5.diff​ :

• there's a missing semicolon in wp-login.php at line 968 which throws a PHPCS error: <?php _e( 'Hide' ) ?>
• the CSS class button-secondary is deprecated and can be removed: it's a pre-existing issue but since we're here... See [38672].

[afercia]

Looking a bit more in depth:

• as mentioned in a previous comment, the clickable area is a bit too small: we're down from the previous 40 by 40 pixels to 50 by 20 pixels: the height is too small especially for touch on small screens, not to mention accessibility
• the focus style could be improved a bit (see screenshot below)
• as there's now visible text, there's no need to have an aria-label: it should be removed together with the JS part meant to update its value
• some CSS values seem a bit "magic numbers", for example line-height: 2.15; based on font-size: 12px; computes to 25.8 pixels: it would be nice to have some meaningful numbers instead (with no decimals)
• on button activation, the icon updates but the visible text doesn't and it's always "Show"

[afercia]

Focus style from 48222.5.diff​

[valentinbora]

Alright, thanks for chiming in.

Next steps:

1. Move button below input control
2. Revert to full label to include the noun "password" (translated length will no longer be an issue due to new location)
3. Update text to Show or Hide based on state via JS
4. Increase button height
5. Code style fixes

[valentinbora]

Screenshots of login and reset password forms with show/hide button underneath input control

[valentinbora]

Show/hide password button underneath input control with full length label

[valentinbora]

@afercia @Clorith patch updated per your request.

Please review and share feedback. Thanks!

[audrasjb]

Hi,

With 5.4 Beta 3 approaching and the Beta period reserved for bugs introduced during the cycle, this is being moved to Future Release. If any maintainer or committer feels this should be included or wishes to assume ownership during a specific cycle, feel free to update the milestone accordingly.

[bobeaston]

Have we forgotten this one?

[indysigner]

Hi all,

The WooCommerce login fields seem to have the same issue (as described at the top of this tread).

Here’s an example with the WC login fields:
​https://www.drweb.de/mein-konto/

Screenshot: ​https://www.dropbox.com/s/wajytyd4qs4ynbu/wc-login-lastpass.png?dl=0

Wondering what’d be the best way to move forward from here?

Thank you,

Markus

[valentinbora]

Patch refresh

[valentinbora]

@audrasjb how do we get attention back onto this one, hoping it could make it into a release?

[audrasjb]

Thanks for bringing attention to that one. Moving for 5.8 consideration :)

[sabernhardt]

restores button focus style, removes redundant aria-label, adjusts margin and padding

[sabernhardt]

focus outline and margin with 48222.8.diff (Firefox/Windows, LastPass)

[sabernhardt]

Changes in 48222.8.diff​:

• The password visibility button needs to keep the focus outline (the change in color is insufficient).
• A small amount of padding (2px) is on both the left and right sides of the button for better readability with the focus outline.
• The button has additional margin on the top and bottom so it does not touch either the input or the submit button. The click target itself is still 30 pixels tall, though the spacing around it adds 16 more.
• The aria-label is removed because the button text gives that information already.
• The password input does not have the side padding anymore, which had made room for the button in front of it.

[sabernhardt]

I can claim ownership for this in 5.9.

[poena]

Hide password button on focus

[poena]

The patch works well. Added a screenshot of the focus style that shows the padding that was described above.

[sabernhardt]

Thanks for the updated screenshot! I tried with the reset password form, though, and that apparently needs positioning adjustments. (The password strength indicator div might need to move before the button.)

[sabernhardt]

moving button between strength indicator and weak password confirmation for reset-password form

[mai21]

Test Report

Env

• WordPress 5.9-alpha-52170 (reproducible on login page while having other strange view for reset pw page)
• Chrome Version 95.0.4638.54 on Ubuntu, while 93.0.4577.82 for Windows
• Windows 10 and Ubuntu 18.04.6
• Theme: Twenty Twenty-One
• Plugin: WP Downgrade , WP beta tester, WooCommerce 5.9

Steps to test

1. Add lastPass chrome extension
2. Open the login page for wordpress
3. Show/hide pw overlap with lastpass icon

With the latest patch https://core.trac.wordpress.org/attachment/ticket/48222/48222.9.diff, the show/hide is outside pw field so no overlap now but please check the following notes:
1- Clicking show/hide pw , the btn width will change with click ​https://jmp.sh/uwsbY87
2- Spacing above/below show /hide pw is too small with respect to the rest of the page
3- PW itself will overlap with LastPass icon ​https://jmp.sh/k5aGpGz
4- For reset PW, it was as follow ​https://jmp.sh/77tDJ6C

Note: I believe this ticket needs design team

[sabernhardt]

Let's revisit this for next release, earlier in the cycle.

[peterwilsoncc]

48222.10.diff​ is 48222.9.diff​ but refreshed against trunk to remove offsets, clean up line ending types.

@sabernhardt do you need anything other than design feedback to take this forward?

While testing, the screenshots @poena uploaded a few months ago appear to still be representative.

[sabernhardt]

That screenshot looks the same (to me) as 48222.10.diff, but this patch does need more than design feedback.

• Setting display: block on .login .button.wp-hide-pw overrides .no-js .hide-if-no-js.
• The JS change affects the user pages (Profile, New User, Edit User). The text includes "password" on larger screens, and the ARIA label is stuck at "Hide password" whether the password is showing or not.

Regarding the design:

• Preventing overlap of password manager icons over the password itself seems impossible without including extra padding. That would not make sense for people who do not use a password manager.
• I do not want to try forcing a width for the toggle button (for example, using both text strings in span tags and hiding one with visibility: hidden). However, moving the icon to the other side of the text could make the width difference between the two text strings less noticeable.
• The bottom margin could be slightly more (16px instead of 12).

I ​drafted a PR to explore some revisions. (Note: The PR is still on my fork and may change.)

Make room for password managers such as LastPass by moving the visibility toggle button, and show the button label text.

Trac ticket: https://core.trac.wordpress.org/ticket/48222

Moving the eye icon after the text can make the width difference less noticeable. Plus, this adds a little more to the bottom margin.

Login

Reset Password

### Videos to show both text strings

Login (desktop and mobile)

​https://user-images.githubusercontent.com/17100257/160100994-255ae74f-e386-481e-bbc0-cdb006eb8699.mp4

On smaller screens, the button is a little taller:

​https://user-images.githubusercontent.com/17100257/160100384-c0f623a8-4eba-472e-8919-e8e856dfea97.mp4

Reset Password (desktop)

​https://user-images.githubusercontent.com/17100257/160101002-01492658-0d98-48b1-b1dd-0e310caf9153.mp4

### Screenshots in Arabic (RTL), _without_ a Password Manager

Login

Reset Password

[sabernhardt]

The patch needs to reflect the new autocomplete values, and would need further revisions to make the login toggle button consistent with the profile page and potential new uses on setup-config.php and options-writing.php (#3534 and #9883).

Changing the type to enhancement since this is well beyond the original scope of a bugfix.

[chaion07]

We reviewed this ticket during a ​recent bug-scrub. Based on the feedback from the team we feel that this ticket including #3534 & #9883 can be moved to Future Release considering only the few days remaining before Feature Freeze gets into effect from 12 April 2022.

Props to @sabernhardt

Cheers!

[sabernhardt]

If someone wants to work on a patch that makes the visibility buttons consistent in all places, feel free to take ownership.

In case showing a separate border around the button and the input is acceptable, I tried ​using flex in this PR. The PR is on my fork because it does not follow the direction this ticket has taken, but I can move it to the main repo if it's worth fixing the bug sooner.