# How do I use getpass?

**URL:** <https://discourse.julialang.org/t/how-do-i-use-getpass/13880>\
**Category:** General Usage\
**Created:** [August 22, 2018, 1:01pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880 "2018-08-22T13:01:19Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:01pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/1 "2018-08-22T13:01:19Z")

</div>

In v0.6.x, I used `Base.getpass` to prompt the user for a password, then just used string interpolation to pass the password to create a login cookie. I think this was possible because previously, `getpass` just returned a string.

Now (in v0.7), it seems `getpass` returns a `SecretBuffer`, which seems like an improvement, but now I don’t know how to use the output.

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 22, 2018, 1:08pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/2 "2018-08-22T13:08:39Z")

</div>

> help?\> Base.SecretBuffer  
> Base.SecretBuffer()
> 
> An IOBuffer-like object where the contents will be securely wiped when garbage collected.
> 
> It is considered best practice to wipe the buffer using Base.shred!(::SecretBuffer) as soon as the secure data are no longer required. When initializing with existing data, the SecretBuffer! method is highly recommended to securely zero the passed argument. Avoid initializing with and converting to Strings as they are unable to be securely zeroed.

You can read from it like any IO object - just avoid putting it into a string (i.e. no simple `read`). Most methods and packages dealing with passwords (hashing etc.) I’ve seen can handle IO directly, so you should be able to pass it directly to them.

Interestingly in both 0.7/1.0, `Base.` has to be prepended for both `getpass` and `SecretBuffer` to get the doc to show up. Might be best to report an issue about that.

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:15pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/3 "2018-08-22T13:15:06Z")

</div>

I’m using the password in a python API, which appears to handle passwords using plain strings only. Ignoring the issue of whether or not that’s a good idea, is `getpass` usable in this situation? Or do I need to use something like `Base.prompt`?

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 22, 2018, 1:19pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/4 "2018-08-22T13:19:05Z")

</div>

Well, yes - but you’re losing all the benefit of using `getpass` in the first place if you need to convert it to a String anyway. The only benefit is the input not showing up in for example the REPL. Maybe there is some kind of preprocessing you can do to avoid sending the password itself as a string?

You can read from the `SecretBuffer` to return a String using `read(x, String)` where `x` is the `SecretBuffer` returned by `getpass`.

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:22pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/5 "2018-08-22T13:22:08Z")

</div>

Thanks. I wonder what the utility of `getpass` in v0.6 actually was, then, since it just returned a `String`…

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 22, 2018, 1:23pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/6 "2018-08-22T13:23:17Z")

</div>

True - but it didn’t display the input while typing, as `Base.prompt` does now.

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:44pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/7 "2018-08-22T13:44:24Z")

</div>

> [@Sukera](#):
>
> You can read from the `SecretBuffer` to return a String using `read(x, String)` where `x` is the `SecretBuffer` returned by `getpass` .

Testing this in the REPL, I only get an empty string…

---

<div class="post-metadata">

**Author:** ![kristoffer.carlsson](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/kristoffer.carlsson/32/22_2.png) [@kristoffer.carlsson](https://discourse.julialang.org/u/kristoffer.carlsson)\
**Post date:** [August 22, 2018, 1:45pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/8 "2018-08-22T13:45:58Z")

</div>

Hmm

```julia
julia> Base.getpass("Password:")
Password::
SecretBuffer(" *******")

julia> read(ans, String)
"hunter2"

```

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:47pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/9 "2018-08-22T13:47:27Z")

</div>

😕

```julia
               _
   _ _ _(_)_ | A fresh approach to technical computing
  (_) | (_) (_) | Documentation: https://docs.julialang.org
   _ _ _| |_ __ _ | Type "?" for help, "]?" for Pkg help.
  | | | | | | |/ _` | |
  | | |_| | | | (_| | | Version 0.7.0 (2018-08-08 06:46 UTC)
 _/ |\ __'_|_|_|\__'_| | Official http://julialang.org/ release
|__/ | x86_64-w64-mingw32

julia> Base.getpass("Test: ")
Test: : SecretBuffer(" *******")

julia> read(ans,String)
┌ Warning: a SecretBuffer was `shred!`ed by the GC; use `shred!` manually after use to minimize exposure.
└ @ Base secretbuffer.jl:169
""

```

I guess that makes sense if you take the warning into account, but trying it again does not yield a warning and still gives an empty string.

p.s. nice password

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 22, 2018, 1:49pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/10 "2018-08-22T13:49:56Z")

</div>

Are you sure you’ve entered something? I get the same behaviour @kristoffer.carlsson observes, on both 0.7 and 1.0.

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 1:52pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/11 "2018-08-22T13:52:16Z")

</div>

Well, as sure as I can be. I’ve been just typing in the same manner as when I was typing everything else in the REPL. I also just tried pasting something from my clipboard, to no avail. This is weird.

_Edit_: I think it is something with the input, though. Using `Base.winprompt` works.

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 22, 2018, 2:10pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/12 "2018-08-22T14:10:14Z")

</div>

Ah, that might explain the difference - I’m (effectively) on Linux (through WSL). Do you mind opening an issue? Offending code should be [here](https://github.com/JuliaLang/julia/blob/fa11decb1df8dd9cd29a6a73024099462d46dc87/base/util.jl#L461) - seems like there are different functions depending on OS. I can only check later today on my main machine whether I can reproduce this.

---

<div class="post-metadata">

**Author:** ![crbinz](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/crbinz/32/1919_2.png) [@crbinz](https://discourse.julialang.org/u/crbinz)\
**Post date:** [August 22, 2018, 2:22pm UTC](https://discourse.julialang.org/t/how-do-i-use-getpass/13880/13 "2018-08-22T14:22:41Z")

</div>

Issue created [here](https://github.com/JuliaLang/julia/issues/28828)