I'm considering emulating the "Show password" functionality, available in some newer browsers, on a website, essentially as a polyfill for browsers which don't. The common way to do this is to [call a JavaScript function which toggles the input type between `password` and `text`](https://stackoverflow.com/questions/9419780/when-a-user-clicks-show-link-display-the-password-hide-it-when-clicked-again#9419925), but given that it's password data, I'm wary of this.

1. Does placing a plaintext password in a `text` input run the risk of the password being scraped by malicious plugins?
2. Specifically, do modern browsers implement any security mechanisms around `password`-type inputs besides the visual obfuscation using dots?
3. Does the above link reflect the current industry best practice for this kind of functionality?