A checkbox for mask/unmask will suffice, masked by default.

Fact: there is a lot people in the world that in the comfort of privacy would like to see what is being typed.

Solution: give them the option to decide.

Everybody else can have their password masked anytime, no compromise.