How to Use HTML to Find Passwords

By Jeffrey Ober

Websites can be designed to be secure, or they can be made simple and easy. If someone wants to make his site secure, there will be no way for you to view a password, even your own password that you just entered; the password will be encrypted before you even send it. However, if someone sets up a web page with very basic security but still requires a password, you may be able to view that password in the plain text of your web page.

Step 1

Call up the page where you believe the password will be found. Normally, this is on a page that is displayed after someone enters her password.

Step 2

View the source of the web page. You can do this through one of the menus in the Internet browser. Very often, you will find this option in the "View" menu--for example, "View," then "Page Source." This will open a new window with the basic text of the web page.

Step 3

Search through the web page for an input tag. The input tag will be a "less than" symbol followed by the word "input." The word "input" may be in lower-case or capital letters; it does not matter. There will usually be a number of these tags grouped together on the page.

Step 4

Search for the input type "hidden." Somewhere after the input tag, you will find a type attribute. This will be the word "type," followed by an equals sign. Each input tag will have a type somewhere. Usually, it will be immediately after the word "input," but it will sometimes appear later in the line. It needs to be before a "greater than" sign that marks the end of the input tag. You need to find a line that reads "type=hidden."

Step 5

Look for the name of the hidden attribute. Somewhere else on that same line, you will see a name attribute. It will read "name," followed by an equals sign. Again, this may appear before or after the type attribute, but it usually appears immediately after "type=hidden." Once you have located a name that reads "name=password," you have found a password.

Step 6

Locate the value of the password. The actual password that has been used will appear further along in the same input tag. The attribute is "value," and whatever appears after the "value=" part of the tag will be the actual password stored.

Tips & Warnings

  • Secure pages will simply not allow you to see passwords; this process only works with simple websites.