Passwords in signup, recovery and login remain masked initially. The primary password field gains an accessible eye/eye-slash action for deliberate show/hide; confirmation stays masked. The reveal state lives only in the input component. Key password fields separately from the preceding email OTP field to avoid native input reuse across verification/password steps. No dependency, native configuration, authentication API or credential persistence change.

Observed Red: the signup integration could not find the show-password action. Green: signup can reveal/re-hide the primary field without changing its value, confirmation stays secure, and recovery begins masked. Existing account adoption and owner-mismatch checks remain covered. A non-destructive Maestro flow exercises the toggle without entering/submitting credentials. Native signup verification still requires a disposable verified mailbox; no real user's account is changed.