The password field in HTTP basic authentication section or the secret fields in OAuth authentication section of the rest api input form are not masked fields. The passwords are shown in clear text not even while just entering them but while listing the inputs.
