In MDL-76478 a bug was fixed around the autocompletion of passwords incorrectly into password fields due to use of autocompletion="off" which is ignore in all modern password managers and was swapped to autocompletion="new-password".

MDL-53048 was an earlier attempt at fixing this bug by introducing a toggle state so you don't get the actually input up front, but combining this with the password unmasking means you have 4 states to the widget which is really confusing. On top of this the input is quite janky and the layout shifts which using the toggles.

I think the desired end state should be:

• there are exactly 2 states, either the password is hidden or it is visible
• with an eyeball toggle on the right side in the bootstrap style
• when you toggle it the layout does not shift at all
• the password field should use a fixed width mono font, in both states, which helps the UX readability with o and 0 vs O and helps fix the layout jumps
• there are cases when you do want the password to auto fill so it should default set the option off but allow easy override

The same should be true in various places that do not use formslib like the main login page template.