diff --git a/api/src/Etemplate/Widget/Password.php b/api/src/Etemplate/Widget/Password.php
index 3e7cbe9997..b0797d787e 100644
--- a/api/src/Etemplate/Widget/Password.php
+++ b/api/src/Etemplate/Widget/Password.php
@@ -58,11 +58,11 @@ class Password extends Etemplate\Widget\Textbox
 			$preserv =& self::get_array(self::$request->preserv, $form_name, true);
 			$preserv = (string)$value;
 
-			if (!empty($value) && ((array_key_exists('viewable', $this->attrs) && $this->attrs['viewable'] === 'false') || $plaintext))
+			// only send password (or hash) to client-side, if explicitly requested
+			if (!empty($value) && (!array_key_exists('viewable', $this->attrs) || !in_array($this->attrs['viewable'], ['1', 'true', true], true)))
 			{
 				$value = str_repeat('*', strlen($preserv));
 			}
-			//$value = str_repeat('*', strlen($preserv));
 		}
 	}
 
@@ -146,4 +146,4 @@ class Password extends Etemplate\Widget\Textbox
 		$response->data($decrypted);
 	}
 }
-Etemplate\Widget::registerWidget(__NAMESPACE__.'\\Password', array('passwd'));
+Etemplate\Widget::registerWidget(__NAMESPACE__.'\\Password', array('passwd'));
\ No newline at end of file