Is it possible to implement password-style fields (masked with asterisks and a Show/Hide button) in AppSheet?

AppSheet AppSheet Q&A
,
1

Hello AppSheet Community,

We’re evaluating an implementation in AppSheet where we need to handle sensitive information (such as passwords, access codes, or other confidential data), and we’d like to know if anyone has successfully implemented behavior similar to a traditional password field.

Our goal is for the value to be masked with asterisks (****) in both Form and Detail views, with the ability for users to reveal or hide the value by tapping a dedicated Show/Hide button.

We’re interested in learning:

  • Is there a native way to achieve this in AppSheet?
  • Can it be implemented using physical columns, virtual columns, actions, Show_If, or any other AppSheet feature?
  • Has anyone implemented a similar solution to protect sensitive information within an AppSheet app?
  • What limitations or challenges did you encounter, especially in Form and Detail views?

Any suggestions, best practices, workarounds, or examples would be greatly appreciated.

Thank you in advance for your help!

2

For form view, this is not possible.
For detail view, you can use two methods.

Method 1

  1. Create a virtual column to put the asterisks (*****).
  2. Create a button with a confirmation message and put the unmasked data there.

Method 2

  1. Create a physical column called Show_Masked_Data (or anything you want).
  2. Create another physical column called Masked_Data_For_Detail_View (or anything you want).
  3. Create an action to change the data as follows:
  • Show_Masked_Data – change it to TRUE or FALSE.
  • Masked_Data_For_Detail_View – if TRUE, show the unmasked data; if FALSE, show ****.
3

Hi @sricse

There’s no feature for that in AppSheet yet, but you can try installing the extension in your browser. Kindly check the attached link.

AppSheet Password Field Fixer

image
image1125×110 9.79 KB

This extension works only in your google browser. Hope this help.

4

Not possible.

5

The detail-view approaches above (a virtual column showing `****` plus a toggle action that swaps to the real value via Show_If) are the right pattern, and as others noted, true masking in the **form editor** isn’t supported — you can’t get native asterisk input there.

But since you specifically mentioned passwords and confidential data, there’s a critical caveat worth flagging before you build this: **the masking is purely cosmetic, not security.** AppSheet stores its data in the backing source (Google Sheet, database, etc.) in plain text. So even if the value shows as `****` in the UI:

- Anyone with access to the underlying sheet/table sees the real value instantly.

- The value travels to the device and lives in the local sync cache, so it’s recoverable client-side.

- A “reveal” action just reads that same plain-text column.

So this technique is fine for *shoulder-surfing / casual concealment* (hiding a value on screen so a bystander can’t read it), but it is **not** appropriate for storing real secrets like account passwords or access codes that need to stay confidential from people who can reach the data source.

If you genuinely need to protect secrets, better patterns are:

1. **Don’t store the secret in AppSheet at all.** Keep credentials in a real secrets manager (e.g. Google Cloud Secret Manager) and have AppSheet call out to it via an Apps Script / webhook / API only when needed.

2. **Store a one-way hash, never the plaintext.** If the use case is “verify a PIN/password,” hash it (e.g. via an Apps Script bot) and compare hashes, so the real value is never sittable in a column.

3. **Lock down the data source and use security filters / role-based Show_If** so only authorized users can ever resolve the unmasked virtual column.

Net: for visual concealment, go with the toggle-action + virtual-column method already described. For actual secret protection, treat AppSheet’s store as plain text and keep the real secret outside it.

6

Just a caution here: masking with asterisks in AppSheet would only be a display trick, not real protection for secrets.

If users are allowed to access the row/column, they should be treated as having access to the underlying value. Virtual columns, Show_If, actions, and detail/form UX can hide or reveal text visually, but they are not the same as secure secret storage.

For actual passwords/API keys/access codes, I would avoid storing the raw value in AppSheet if possible. Use an external secret manager or backend service, and only store a label/status/last-used value in the app. If the use case is just casual privacy, then a masked virtual column plus a reveal action can work, but I would not use it for real credentials.