diff --git a/admin/templates/setting_configpasswordunmask.mustache b/admin/templates/setting_configpasswordunmask.mustache
index bf00ea7bcc2..cf7565c1932 100644
--- a/admin/templates/setting_configpasswordunmask.mustache
+++ b/admin/templates/setting_configpasswordunmask.mustache
@@ -35,18 +35,14 @@
 }}
 <div class="form-password">
     <span data-passwordunmask="wrapper" data-passwordunmaskid="{{ id }}">
-        <noscript>
-            <!-- Backwards compatability for Behat -->
-            <input  type="password"
-                    name="{{ name }}"
-                    id="{{ id }}"
-                    value="{{ value }}"
-                    size="{{ size }}"
-                    >
-        </noscript>
         <span class="visibleifjs">
             <span data-passwordunmask="editor">
-                <!-- The input in the noscript will be moved here as part of the page load -->
+                <input  type="hidden"
+                        name="{{ name }}"
+                        id="{{ id }}"
+                        value="{{ value }}"
+                        size="{{ size }}"
+                        >
             </span>
             <a href="#" data-passwordunmask="edit" title="{{ edithint }}">
                 <span data-passwordunmask="displayvalue">{{> core_form/element-passwordunmask-fill }}</span>
@@ -59,6 +55,15 @@
                 {{# str }} passwordunmaskinstructions, form {{/ str }}
             </span>
         </span>
+        <noscript>
+            <!-- Backwards compatability for Behat -->
+            <input  type="password"
+                    name="{{ name }}"
+                    id="{{ id }}"
+                    value="{{ value }}"
+                    size="{{ size }}"
+                    >
+        </noscript>
     </span>
 </div>
 {{#js}}
diff --git a/theme/boost/templates/core_admin/setting_configpasswordunmask.mustache b/theme/boost/templates/core_admin/setting_configpasswordunmask.mustache
index d5325540c22..257e81ff20c 100644
--- a/theme/boost/templates/core_admin/setting_configpasswordunmask.mustache
+++ b/theme/boost/templates/core_admin/setting_configpasswordunmask.mustache
@@ -35,19 +35,15 @@
 }}
 <div class="form-password">
     <span data-passwordunmask="wrapper" data-passwordunmaskid="{{ id }}">
-        <noscript>
-            <!-- Backwards compatability for Behat -->
-            <input  type="password"
-                    name="{{ name }}"
-                    id="{{ id }}"
-                    value="{{ value }}"
-                    size="{{ size }}"
-                    class="form-control d-inline-block"
-                    >
-        </noscript>
         <span class="visibleifjs">
             <span data-passwordunmask="editor">
-                <!-- The input in the noscript will be moved here as part of the page load -->
+                <input  type="hidden"
+                        name="{{ name }}"
+                        id="{{ id }}"
+                        value="{{ value }}"
+                        size="{{ size }}"
+                        class="form-control d-inline-block"
+                        >
             </span>
             <a href="#" data-passwordunmask="edit" title="{{ edithint }}">
                 <span data-passwordunmask="displayvalue">{{> core_form/element-passwordunmask-fill }}</span>
@@ -60,6 +56,16 @@
                 {{# str }} passwordunmaskinstructions, form {{/ str }}
             </span>
         </span>
+        <noscript>
+            <!-- Backwards compatability for Behat -->
+            <input  type="password"
+                    name="{{ name }}"
+                    id="{{ id }}"
+                    value="{{ value }}"
+                    size="{{ size }}"
+                    class="form-control d-inline-block"
+                    >
+        </noscript>
     </span>
 </div>
 {{#js}}