ESPHome removes the contents of password-mode text fields from its web server’s data responses. The interface displayed a mask, but another field in the same response still carried the real value, exposing the secret to anyone able to read that response.
J. Nick Koston corrects both the live event stream and the individual data endpoint used by web interface versions 2 and 3. Password inputs start empty and still accept a replacement value. Deprecated version 1 renders the raw value in its own page and is not covered by this correction.