#22697: Android: mask gateway token as password field with visibility toggle
app: android
size: XS
Cluster:
Android Ed25519 Enhancements
## Summary
- Treats the gateway token input as a secret field using `PasswordVisualTransformation` (masked with dots by default)
- Adds a trailing eye icon (`Visibility`/`VisibilityOff`) to toggle between masked and clear-text display
- Lightweight alternative to #22238 — prevents casual shoulder-surfing of the auth token without blocking screenshots app-wide
This could be merged **instead of** or **together with** #22238. The approaches are complementary: this PR redacts the field content itself, while #22238 prevents screenshots of the entire Advanced section.
## Test plan
- [x] Open Settings → expand Advanced → verify gateway token is masked with dots
- [x] Tap the eye icon → verify token becomes visible in clear text
- [x] Tap the eye icon again → verify token is re-masked
- [x] Collapse and re-expand Advanced → verify token resets to masked state
- [x] Verify no regressions in other settings fields
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
Adds password masking with visibility toggle to the gateway token field in Android settings. The token is masked by default using `PasswordVisualTransformation` and includes an eye icon to toggle visibility, protecting against shoulder-surfing while maintaining easy access when needed.
- Applied `PasswordVisualTransformation` to mask token input by default
- Added visibility toggle icon button (`Visibility`/`VisibilityOff`) with proper accessibility labels
- Token visibility state resets to masked when Advanced section is collapsed/re-expanded (state is scoped inside `AnimatedVisibility`)
- Clean implementation following Material Design 3 patterns
<h3>Confidence Score: 5/5</h3>
- Safe to merge - straightforward UI enhancement with no functional risks
- Simple, well-implemented UI change that adds password masking to a sensitive field. Uses standard Compose patterns, proper state management, and includes accessibility support. No logic errors, security issues, or edge cases identified.
- No files require special attention
<sub>Last reviewed commit: c45e6b7</sub>
<!-- greptile_other_comments_section -->
<sub>(4/5) You can add custom instructions or style guidelines for the agent [here](https://app.greptile.com/review/github)!</sub>
<!-- /greptile_comment -->
Most Similar PRs
#22238: Android: security hardening to prevent screenshots of manual gatewa...
by SimonSchubert · 2026-02-20
74.0%
#5867: Android: Add BouncyCastle Ed25519 fallback and gateway token UI
by brandonpollack23 · 2026-02-01
70.9%
#11205: Android: fix gateway connection and canvas URL for Tailscale serve
by emonty · 2026-02-07
66.9%
#22744: feat: masked secrets — prevent agents from accessing raw API keys
by theMachineClay · 2026-02-21
66.8%
#19548: fix(android): show scaffold instead of raw JSON on canvas auth errors
by gregmousseau · 2026-02-17
66.8%
#13321: android/gateway: harden manual connect identity and A2UI UX
by m888m · 2026-02-10
66.8%
#7124: feat: Add password toggle visibility to all platforms
by gibtang · 2026-02-02
66.4%
#17765: fix: add link to settings when chat shows auth error
by MisterGuy420 · 2026-02-16
66.4%
#10093: fix: import gateway token from URL param into localStorage
by devjiro76 · 2026-02-06
66.0%
#15965: feat(ui): show inline token input on Chat page when auth fails
by alextnetto · 2026-02-14
65.8%