You have to code it like a password to show up like * and work. I was thinking the same thing when I used it as well. Someone can just inspect the page and see your keys.