I partially agree with scottclark, even if I wouldn't call it "ajaxy", as it would not need any ajax communication. Just a simple JS changing the "type" option.
But the default should be masking password, not vice versa.
Abu Rideh, 37, has been on a control order since 2005. He had been arrested in 2001, and detained under the Anti-Terrorism, Crime and Security Act but in eight years, he has never been charged with any offence, and because whatever evidence there is against him is "secret", he doesn't even know what he is accused of. All this has left this man, who was psychologically fragile to start with, physically and mentally broken.