diff --git a/neveko-gui/src/apps/lock_screen.rs b/neveko-gui/src/apps/lock_screen.rs
index 1bbeead..5f1cd4d 100644
--- a/neveko-gui/src/apps/lock_screen.rs
+++ b/neveko-gui/src/apps/lock_screen.rs
@@ -45,6 +45,8 @@ impl LockScreenApp {
         self.is_locked
     }
     pub fn set_lock(&mut self) {
+        // clear wallet password from user environment on screen lock
+        std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, "");
         self.is_locked = true
     }
 }
@@ -58,6 +60,7 @@ impl eframe::App for LockScreenApp {
                 ui.add(egui::TextEdit::singleline(&mut self.lock_screen.credential).password(true));
             });
             if ui.button("Login").clicked() {
+                std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, self.lock_screen.credential.clone());
                 // Get the credential hash from lmdb
                 let s = db::Interface::open();
                 let r = db::Interface::read(&s.env, &s.handle, CREDENTIAL_KEY);
diff --git a/neveko-gui/src/login.rs b/neveko-gui/src/login.rs
index fec4c66..2deb755 100644
--- a/neveko-gui/src/login.rs
+++ b/neveko-gui/src/login.rs
@@ -9,15 +9,18 @@ use sha2::{
 pub struct LoginApp {
     pub credential: String,
     pub is_cred_generated: bool,
+    pub is_not_showing_password: bool,
 }
 
 impl Default for LoginApp {
     fn default() -> Self {
         let credential = utils::empty_string();
         let is_cred_generated = false;
+        let is_not_showing_password = true;
         LoginApp {
             credential,
             is_cred_generated,
+            is_not_showing_password,
         }
     }
 }
@@ -33,12 +36,17 @@ impl eframe::App for LoginApp {
             ui.label("it will not be displayed again after logging in");
             ui.label("use this or set your own secure password.");
             ui.horizontal(|ui| {
-                let cred_label = ui.label("credential: \t");
-                ui.text_edit_singleline(&mut self.credential)
-                    .labelled_by(cred_label.id);
+                ui.label("credential: \t");
+                let mut show_password = self.is_not_showing_password;
+                ui.add(egui::TextEdit::singleline(&mut self.credential).password(self.is_not_showing_password));
+                if ui.checkbox(&mut show_password, "show password").changed() {
+                    self.is_not_showing_password = !self.is_not_showing_password;
+                }
             });
             if ui.button("Login").clicked() {
-                // TODO(c2m): security / encryption, for now only the hash of auth put in lmdb
+                // temporarily set the password to user environment and clear with screenlock
+                // we set it here for the initial launch of neveko
+                std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, self.credential.clone());
                 let k = CREDENTIAL_KEY;
                 let mut hasher = Sha512::new();
                 hasher.update(self.credential.clone());
diff --git a/neveko-gui/src/wrap_app.rs b/neveko-gui/src/wrap_app.rs
index 30ec9d1..b00da21 100644
--- a/neveko-gui/src/wrap_app.rs
+++ b/neveko-gui/src/wrap_app.rs
@@ -222,6 +222,8 @@ impl eframe::App for WrapApp {
 
     #[cfg(feature = "glow")]
     fn on_exit(&mut self, _gl: Option<&glow::Context>) {
+        // sanity check that wallet password is no longer in user environment
+        std::env::set_var(neveko_core::MONERO_WALLET_PASSWORD, "");
         utils::kill_child_processes(false);
     }
 }
@@ -297,18 +299,6 @@ impl WrapApp {
             ctx.request_repaint();
         });
     }
-
-    /*
-       TODO(c2m): SECURITY!:
-       Ok, so this here is by far the greatest security loophole.
-       An attacker could reset the credential in the db to any value,
-       besides setting the wallet password on initial load, better change
-       the key for storing the random 32 byte credential to be some strong
-       user entry and then reset wallet password with that. But anyways if
-       someone has access to the machine it sucks because neveko gpg key
-       doesn't have a passphrase.
-    */
-
     /// Validate that a credential was set by the user;
     fn check_credential_key(&mut self, tx: Sender<bool>, ctx: egui::Context) {
         tokio::spawn(async move {