[PM-42337] Password / hidden fields revealing actual data length

[servint]

Steps To Reproduce

1. Navigate to any saved login or item containing a custom hidden field.
2. Click on the 'Reveal Data' icon.

Note that the number of masked symbols matches the actual number of characters in the password or hidden field data. In the updated Web, Browser, and Desktop clients, this behavior differs from that of the Android app, creating an inconsistency and potential security risks.

Expected Result

The masked password field and the hidden field data appear to be the same length, regardless of the actual number of characters contained within each field.

Actual Result

The length of the masked symbols matches the actual hidden data, unintentionally revealing the true length of the concealed information.

Screenshots or Videos

No response

Additional Context

No response

Build Version

2026.8.0

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

Samsung Galaxy S26 Plus
Android 16, One UI 8.5

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-42337

[pamperer562580892423]

Another user here.

And some context:

• there was a corresponding issue for the clients: [Firefox][Edge][Extension][Web] Password mask now shows the true length of the password clients#13867
• ... that was recently fixed by this community PR: [PM-27495] Do not show true length of password in password mask clients#17052

bitwarden/clients#13867 mentions that this "bug" was a regression - until it was fixed now - as older clients did hide the true length. I'm not sure about the old mobile apps behaviour here - but it is an inconsistent UI/UX now that the mobile apps do not hide the true length.

[rmcdowell-bitwarden]

Hi there,

Thank you for your report!

I was able to reproduce this issue, and I have flagged this to our engineering team.

If you wish to add any further information/screenshots/recordings etc., please feel free to do so at any time - our engineering team will be happy to review these.

Thanks once again!