"Viewing" private data for purposes of verification of the issue. How about you just don't ship passwords in the application like some negligent troglodyte?