# Why is my github password displayed!

**URL:** <https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861>\
**Category:** Meta Discussion\
**Created:** [August 23, 2021, 4:58pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861 "2021-08-23T16:58:32Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![dgpdx](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@dgpdx](https://discourse.julialang.org/u/dgpdx)\
**Post date:** [August 23, 2021, 4:58pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/1 "2021-08-23T16:58:32Z")

</div>

I just clicked on my id in another post and discovered my github password was displayed! This is a gross violation of my security! Please stop this practice!

---

<div class="post-metadata">

**Author:** ![johnmyleswhite](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/johnmyleswhite/32/31_2.png) [@johnmyleswhite](https://discourse.julialang.org/u/johnmyleswhite)\
**Post date:** [August 23, 2021, 5:01pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/2 "2021-08-23T17:01:23Z")

</div>

Can you give an example? This has never happened to anyone else as far I know.

Did you, for example, enter your Github password when you were asked to enter a URL instead?

---

<div class="post-metadata">

**Author:** ![dgpdx](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@dgpdx](https://discourse.julialang.org/u/dgpdx)\
**Post date:** [August 23, 2021, 5:04pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/3 "2021-08-23T17:04:01Z")

</div>

That must be the problem, thanks. I’ll correct it immediately.

---

<div class="post-metadata">

**Author:** ![mbauman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mbauman/32/31082_2.png) [@mbauman](https://discourse.julialang.org/u/mbauman)\
**Post date:** [August 23, 2021, 5:04pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/4 "2021-08-23T17:04:06Z")

</div>

It looks like you entered your GitHub password into the field designated for your GitHub username. You should edit that field and change your GitHub password immediately and audit/expire all GitHub sessions.

---

<div class="post-metadata">

**Author:** ![mbauman](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/mbauman/32/31082_2.png) [@mbauman](https://discourse.julialang.org/u/mbauman)\
**Post date:** [August 23, 2021, 5:08pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/5 "2021-08-23T17:08:20Z")

</div>

For expediency, I’ve cleared that field on your behalf. You can edit it in your user preferences in the “Profile” tab.

---

<div class="post-metadata">

**Author:** ![dgpdx](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@dgpdx](https://discourse.julialang.org/u/dgpdx)\
**Post date:** [August 23, 2021, 5:13pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/6 "2021-08-23T17:13:32Z")

</div>

Testing github user name

---

<div class="post-metadata">

**Author:** ![dgpdx](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@dgpdx](https://discourse.julialang.org/u/dgpdx)\
**Post date:** [August 23, 2021, 5:14pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/7 "2021-08-23T17:14:17Z")

</div>

Better now.

---

<div class="post-metadata">

**Author:** ![Krastanov](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/krastanov/32/6817_2.png) [@Krastanov](https://discourse.julialang.org/u/Krastanov)\
**Post date:** [August 23, 2021, 5:42pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/8 "2021-08-23T17:42:10Z")

</div>

Just for reference for other readers: Discourse (or any other modern software using features like log-in-with-github or log-in-with-whatever) would never even get access to these passwords. The whole point of these “log-in-with-something” features is to avoid password management (the login provider creates temporary tokens and permissions on their behalf, never sharing passwords).

Even more, github itself does not know your password either: they only know a salted hash from which it should be impossible to derive your password (that would be a prohibitively expensive computational operation). When you try to login, they transform the password into the hash (a cheap operation) and compare hashes.

This all to say: if you suspect a service even knows the password you use to log in (let alone it carelessly displays it somewhere), you should already be worried about their security competency.

---

<div class="post-metadata">

**Author:** ![Sukera](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@Sukera](https://discourse.julialang.org/u/Sukera)\
**Post date:** [August 23, 2021, 5:46pm UTC](https://discourse.julialang.org/t/why-is-my-github-password-displayed/66861/9 "2021-08-23T17:46:38Z")

</div>

The problem here was mistaking a purely informational field about a username for a password field - entering a password during account linking (even though that’s not what happened here) is usually a common practice, since it’s common to have to log into the account that’s being linked to verify that the linking is desired.