Best practices for “show password” functionality

In a mobile app context, when the user is presented with a dialog specifically asking for a password, what are the best practices for allowing the user to show the password while entering it into the field?

In particular, I’m wondering about:

• writing “show password” versus using an eye icon.
• the location of the element (see locations 1 through 4 in the image), especially when trying . Using an eye icon in position 3 is common but can be problematic with long passwords.
• showing the password only when pressed versus toggling visibility on/off with each press.