Do password fields on registration forms need to be masked?

Simply put, yes.

1. Why are passwords masked?
2. Is used to mask the password?

Why are passwords masked?

Password masking is an attempt to protect the user against shoulder surfers who look at the screen. However, password masking does not protect against a skilled criminal who is well versed in the art of stealing passwords. They can look at the keyboard and see what is being typed.

Is used to mask the password?

A masked password is an obscure string representation of a real password. To mask a password a user will use an 'codec'. The codec takes in the real password and outputs the masked version. A user can then replace the real password in the configuration files with the new masked password.