diff --git a/l4d2web/static/js/password-reveal.js b/l4d2web/static/js/password-reveal.js
new file mode 100644
index 0000000..516c622
--- /dev/null
+++ b/l4d2web/static/js/password-reveal.js
@@ -0,0 +1,13 @@
+document.addEventListener('click', (e) => {
+  const btn = e.target.closest('[data-password-toggle]');
+  if (!btn) return;
+  const id = btn.dataset.passwordToggle;
+  const mask = document.querySelector(`[data-password-field="${id}"].password-mask`);
+  const value = document.querySelector(`[data-password-field="${id}"].password-value`);
+  if (!mask || !value) return;
+  const hidden = value.hidden;
+  value.hidden = !hidden;
+  mask.hidden = hidden;
+  btn.textContent = hidden ? 'hide' : 'show';
+  btn.setAttribute('aria-label', hidden ? 'Hide RCON password' : 'Show RCON password');
+});