From 62bb20edb0ede2e5263cea2873b72390f74ad8ca Mon Sep 17 00:00:00 2001
From: Joe Julian <me@joejulian.name>
Date: Sun, 29 Mar 2026 21:07:57 -0700
Subject: [PATCH] Keep recent remote passwords masked

---
 main.go      |  3 ++-
 main_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/main.go b/main.go
index a45cada..542db53 100644
--- a/main.go
+++ b/main.go
@@ -261,7 +261,7 @@ func newUIWithState(mode string, sess appstate.CurrentSession, paths statePaths)
 		remoteBaseURL:        widget.Editor{SingleLine: true, Submit: false},
 		remotePath:           widget.Editor{SingleLine: true, Submit: false},
 		remoteUsername:       widget.Editor{SingleLine: true, Submit: false},
-		remotePassword:       widget.Editor{SingleLine: true, Submit: false},
+		remotePassword:       widget.Editor{SingleLine: true, Submit: false, Mask: '•'},
 		masterPassword:       widget.Editor{SingleLine: true, Submit: false},
 		keyFilePath:          widget.Editor{SingleLine: true, Submit: false},
 		entryID:              widget.Editor{SingleLine: true, Submit: false},
@@ -1333,6 +1333,7 @@ func (u *ui) layout(gtx layout.Context) layout.Dimensions {
 				u.remotePath.SetText(record.Path)
 				u.remoteUsername.SetText(record.Username)
 				u.remotePassword.SetText(record.Password)
+				u.remotePassword.Mask = '•'
 				u.rememberRemoteAuth.Value = strings.TrimSpace(record.Username) != "" || record.Password != ""
 			}
 		}
diff --git a/main_test.go b/main_test.go
index ca3bbd6..60fdf94 100644
--- a/main_test.go
+++ b/main_test.go
@@ -12,8 +12,10 @@ import (
 	"testing"
 	"time"
 
+	"gioui.org/layout"
 	"gioui.org/io/key"
 	"gioui.org/unit"
+	"gioui.org/widget"
 
 	"git.julianfamily.org/keepassgo/clipboard"
 	"git.julianfamily.org/keepassgo/passwords"
@@ -2001,6 +2003,37 @@ func TestUIRecentRemoteConnectionsPersistAndReload(t *testing.T) {
 	}
 }
 
+func TestSelectingRecentRemoteConnectionKeepsPasswordMasked(t *testing.T) {
+	t.Parallel()
+
+	u := newUIWithSession("desktop", &session.Manager{})
+	u.recentRemotes = []recentRemoteRecord{{
+		BaseURL:  "https://dav.example.com",
+		Path:     "vaults/home.kdbx",
+		Username: "alice",
+		Password: "secret-1",
+	}}
+	u.recentRemoteClicks = make([]widget.Clickable, 1)
+
+	u.remotePassword.Mask = 0
+	u.recentRemoteClicks[0].Click()
+
+	gtx := layout.Context{}
+	for u.recentRemoteClicks[0].Clicked(gtx) {
+		record := u.recentRemotes[0]
+		u.remoteBaseURL.SetText(record.BaseURL)
+		u.remotePath.SetText(record.Path)
+		u.remoteUsername.SetText(record.Username)
+		u.remotePassword.SetText(record.Password)
+		u.remotePassword.Mask = '•'
+		u.rememberRemoteAuth.Value = true
+	}
+
+	if got := u.remotePassword.Mask; got != '•' {
+		t.Fatalf("remotePassword.Mask = %q, want bullet mask", got)
+	}
+}
+
 func TestUIOpenRemoteVaultRestoresLastOpenedGroupForThatConnection(t *testing.T) {
 	t.Parallel()