--- title: "EBA Q&A 2018_4366 — Q&A — Showing a password after it has been masked [Final Q&A]" shortTitle: "EBA Q&A 2018_4366 — Q&A — Showing a password after it has been masked [Final Q&A]" answer_id: EBA_QA_2018_4366 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98(1) PSD2" date: 8 February 2019 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4366 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 8 February 2019" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4366" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4366, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2019-02-08" question_submitted_on: "2018-11-09" locators: published_on: "EBA Q&A register entry 2018_4366, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4366, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 8 Feb 2019 [Final Q&A]** *Final Q&A · EBA Q&A register, 8 February 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4366)* | | | |---|---| | **Full title** | EBA Q&A 2018_4366 — Q&A — Showing a password after it has been masked \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4366 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 8 February 2019; question submitted 9 November 2018 | | **Legal basis** | Article 98(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Showing a password after it has been masked** ### Question Article 22, 2(a) states that "personalised security credentials are masked when displayed and are not readable in their full extent when input by the payment service user during the authentication". Is it ok to offer the user a "show password"-button, so the user can verify that correct password has been entered, before fulfilling an authentication? ### Background In Bank “N” ID Web-client the users enter their security credentials in three different windows when authenticating. First you enter your SSN, then in the next window you enter your one-time-password and finally you enter the personal password. Our question is related to the latter; if the security credential is masked when displayed, can the user be offered a "show password"-button, so the entered password can be controlled by the end user in plain text before submitting it? *** ### Answer Article 22(1) of the Commission Delegated Regulation (EU) 2018/389 states that payment service providers (PSPs) shall ensure “the confidentiality and integrity of the personalised security credentials of the payment service user \[...\] during all phases of authentication”. Article 22(2) continues by stating that for that purpose they should ensure that “personalised security credentials are masked when displayed and are not readable in their full extent when input by the payment service user during the authentication”; “personalised security credentials in data format, as well as cryptographic materials related to the encryption of the personalised security credentials are not stored in plain text”; and “secret cryptographic material is protected from unauthorised disclosure”. In other words, personalised security credentials (PSC) cannot be stored in plain text, PSCs shall be protected from unauthorised disclosure and they should be masked when displayed and not readable in their full extent. It follows that the PSP should not display the password if readable in its full extent. However, it could display one character of the password as and when the payment service user inputs it, while masking the other characters of the password. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4366) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)