https://github.com/vim-jp/issues/issues/1244

inputsecret.patch

diff --git a/src/ex_getln.c b/src/ex_getln.c
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -27,6 +27,7 @@ struct cmdline_info
     char_u	*cmdbuff;	/* pointer to command line buffer */
     int		cmdbufflen;	/* length of cmdbuff */
     int		cmdlen;		/* number of chars in command line */
+    int		cmdprevlen;		/* number of chars in command line */
     int		cmdpos;		/* current cursor position */
     int		cmdspos;	/* cursor column on screen */
     int		cmdfirstc;	/* ':', '/', '?', '=', '>' or NUL */
@@ -857,6 +858,7 @@ getcmdline_int(
     struct cmdline_info save_ccline;
     int		did_save_ccline = FALSE;
     int		cmdline_type;
+    int		save_cmdline_star = cmdline_star;
 
     if (ccline.cmdbuff != NULL)
     {
@@ -1026,6 +1028,8 @@ getcmdline_int(
 
 	cursorcmd();		/* set the cursor on the right spot */
 
+	ccline.cmdprevlen = ccline.cmdlen;
+
 	/* Get a character.  Ignore K_IGNORE and K_NOP, they should not do
 	 * anything, such as stop completion. */
 	do
@@ -2297,6 +2301,14 @@ getcmdline_int(
 		bracketed_paste(PASTE_CMDLINE, FALSE, NULL);
 		goto cmdline_changed;
 
+	case Ctrl_X:
+		if (save_cmdline_star > 0)
+		{
+		    cmdline_star = !cmdline_star;
+		    goto cmdline_changed;
+		}
+		// FALLTHROUGH
+
 	default:
 #ifdef UNIX
 		if (c == intr_char)
@@ -2439,6 +2451,7 @@ returncmd:
     trigger_cmd_autocmd(cmdline_type, EVENT_CMDLINELEAVE);
 
     State = save_State;
+    cmdline_star = save_cmdline_star;
 #ifdef HAVE_INPUT_METHOD
     if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
 	im_save_status(b_im_ptr);
@@ -3163,16 +3176,23 @@ draw_cmdline(int start, int len)
     int		i;
 
     if (cmdline_star > 0)
-	for (i = 0; i < len; ++i)
+    {
+	int incr = ccline.cmdlen > ccline.cmdprevlen;
+
+	for (i = 0; i < len - incr; ++i)
 	{
 	    msg_putchar('*');
 	    if (has_mbyte)
 		i += (*mb_ptr2len)(ccline.cmdbuff + start + i) - 1;
 	}
-    else
+	if (!incr)
+	    return;
+	start += len - 1;
+	len = 1;
+    }
 #endif
 #ifdef FEAT_ARABIC
-	if (p_arshape && !p_tbidi && enc_utf8 && len > 0)
+    if (p_arshape && !p_tbidi && enc_utf8 && len > 0)
     {
 	static int	buflen = 0;
 	char_u		*p;