[nacs]

You're literally putting the password in plain-text into the (unencrypted) browser bookmarks (and also into your terminal where it's likely logged to your ~/.bash_history).

That is the bigger security issue you have, not how Firefox is handling the display of the URL.

If anything, Firefox is highlighting your insecure security practice.

[JonathanBeuys]

I'm not typing them in my terminal. I have scripts that automate my workflow. And part of it is logging me into websites.

Regarding storing them in plain text: That's not much different from ssh keys. When someone can read your ssh key, they can log in as you.

If you know a better way to automatically log a user into a website, let us know!

[vehemenz]

Every modern password manager has this capability built in.