55

I want to hide password input. I see many answers in stackoverflow but I can't verify value if I press backspace. The condition return false.

I tried several solution to overwrite the function but I got an issue with buffer if I press backspace, I got invisible character \b.

I press : "A", backspace, "B", I have in my buffer this : "\u0041\u0008\u0042" (toString() = 'A\bB') and not "B".

I have :

var readline = require('readline');

var rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout
});

rl.question("password : ", function(password) {
    console.log("Your password : " + password);
});

13 Answers 13

61

This can be handled with readline by intercepting the output through a muted stream, as is done in the read project on npm (https://github.com/isaacs/read/blob/master/lib/read.js):

var readline = require('readline');
var Writable = require('stream').Writable;

var mutableStdout = new Writable({
  write: function(chunk, encoding, callback) {
    if (!this.muted)
      process.stdout.write(chunk, encoding);
    callback();
  }
});

mutableStdout.muted = false;

var rl = readline.createInterface({
  input: process.stdin,
  output: mutableStdout,
  terminal: true
});

rl.question('Password: ', function(password) {
  console.log('\nPassword is ' + password);
  rl.close();
});

mutableStdout.muted = true;
2
  • 1
    Though this code works fine, I wonder if it's proper. You don't pass the callback to stdout.write but call it with success unconditionally, and suppress any errors that way. Unfortunately, passing the callback makes it stop working and requires the muting to be done with a timeout of 0 (which then smells like a race condition to me).
    – Marnes
    Sep 20, 2020 at 11:58
  • Don't miss Enter key: if (!this.muted || ['\n', '\r\n'].includes(chunk.toString())) ... Jan 3, 2022 at 1:21
53

Overwrite _writeToOutput of application's readline interface : https://github.com/nodejs/node/blob/v9.5.0/lib/readline.js#L291

To hide your password input, you can use :

FIRST SOLUTION : "password : [=-]"

This solution has animation when you press a touch :

password : [-=]
password : [=-]

The code :

var readline = require('readline');

var rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout
});

rl.stdoutMuted = true;

rl.query = "Password : ";
rl.question(rl.query, function(password) {
  console.log('\nPassword is ' + password);
  rl.close();
});

rl._writeToOutput = function _writeToOutput(stringToWrite) {
  if (rl.stdoutMuted)
    rl.output.write("\x1B[2K\x1B[200D"+rl.query+"["+((rl.line.length%2==1)?"=-":"-=")+"]");
  else
    rl.output.write(stringToWrite);
};

This sequence "\x1B[2K\x1BD" uses two escapes sequences :

  • Esc [2K : clear entire line.
  • Esc D : move/scroll window up one line.

To learn more, read this : http://ascii-table.com/ansi-escape-sequences-vt-100.php

SECOND SOLUTION : "password : ****"

var readline = require('readline');

var rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout
});

rl.stdoutMuted = true;

rl.question('Password: ', function(password) {
  console.log('\nPassword is ' + password);
  rl.close();
});

rl._writeToOutput = function _writeToOutput(stringToWrite) {
  if (rl.stdoutMuted)
    rl.output.write("*");
  else
    rl.output.write(stringToWrite);
};

You can clear history with :

rl.history = rl.history.slice(1);
14
  • 1
    \033[2K\033D, uses two sequences "Esc[2K" and "EscD". First, clear entire line, second move/scroll window up one line. Jun 18, 2014 at 12:36
  • 3
    If you are using strict mode change '\033[2K\033[200D' to '\x1B[2K\x1B[200D'. This just changes the deprecated octal escapes into equivalent hexadecimal escapes. Jul 29, 2016 at 20:24
  • 2
    The second solution has a weird behaviour of the return key. It prints Password: , then if you enter 'a' and press return the total content of the first output line is Password: ** without a line break. Any subsequent console logging will log right after that in the same line. I fixed it by testing for the newline character in rl._writeToOutput like so: if (rl.stdoutMuted && stringToWrite != '\r\n' && stringToWrite != '\n' && stringToWrite != '\r')
    – chrwoizi
    Sep 12, 2018 at 13:22
  • 1
    @chrwoizi yeah this is also true when erasing the password, as the interface will re-render the whole line with the test. try ``` if (password) { rl._writeToOutput = (s) => { const v = s.split(question) if (v.length == '2') { rl.output.write(question) rl.output.write(''.repeat(v[1].length)) } else { rl.output.write('') } } } ``` (github.com/artdecocode/reloquent/blob/master/src/lib/ask.js#L23) or NPM package reloquent
    – zavr
    Oct 7, 2018 at 23:20
  • 4
    Using a private (internal part) of a class/interface (here __writeToOutput for readline) wouldn't be a good idea. The types can only commit to maintain their public interface.
    – Alex Sed
    Mar 30, 2022 at 6:36
16

You can use the readline-sync module instead of node's readline.

Password-hiding functionality is built in via it's "hideEchoBack" option.

https://www.npmjs.com/package/readline-sync

1
  • readline-sync in conjuction with ttys allows you to have a password prompt without showing the typed chars. Thanks for the link! :)
    – greduan
    Mar 11, 2016 at 5:37
10

Another method using readline:

var readline = require("readline"),
    rl = readline.createInterface({
      input: process.stdin,
      output: process.stdout
    });

rl.input.on("keypress", function (c, k) {
  // get the number of characters entered so far:
  var len = rl.line.length;
  // move cursor back to the beginning of the input:
  readline.moveCursor(rl.output, -len, 0);
  // clear everything to the right of the cursor:
  readline.clearLine(rl.output, 1);
  // replace the original input with asterisks:
  for (var i = 0; i < len; i++) {
    rl.output.write("*");
  }
});

rl.question("Enter your password: ", function (pw) {
  // pw == the user's input:
  console.log(pw);
  rl.close();
});
4
  • 1
    Illustrates good solution / simple + effective, and doesn't require installing a module or overwriting a private API. Easy to add a flag to toggle between keypress processing depending whether question response should be hidden or not.
    – Shaun
    Feb 1, 2021 at 5:08
  • 1
    This solution doesn't work for me as each character is shown briefly before being replaced
    – Kian
    Nov 30, 2021 at 14:00
  • Suggest rl.output.write('*'.repeat(len)); instead of for loop.
    – Ben
    Apr 21, 2022 at 21:27
  • 1
    This still writes the input to stdout - before clearing it and writing *, depending on OS/setup may be intercepted/errornous thus MAY LEAK the output, whereas _writeToOutput is ugly but intercepts it before writing.
    – Michael B.
    Aug 14, 2022 at 20:52
8

My solution, scraped together from various bits online:

import readline from 'readline';

export const hiddenQuestion = query => new Promise((resolve, reject) => {
  const rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout
  });
  const stdin = process.openStdin();
  process.stdin.on('data', char => {
    char = char + '';
    switch (char) {
      case '\n':
      case '\r':
      case '\u0004':
        stdin.pause();
        break;
      default:
        process.stdout.clearLine();
        readline.cursorTo(process.stdout, 0);
        process.stdout.write(query + Array(rl.line.length + 1).join('*'));
        break;
    }
  });
  rl.question(query, value => {
    rl.history = rl.history.slice(1);
    resolve(value);
  });
});

Usage is like this:

// import { hiddenQuestion } from './hidden-question.js';

const main = async () => {
  console.log('Enter your password and I will tell you your password! ');
  const password = await hiddenQuestion('> ');
  console.log('Your password is "' + password + '". ');
};

main().catch(error => console.error(error));
2
  • 1
    For a multiple prompt script, to avoid extra new lines being printed for each call to hiddenQuestion, you'll want to put a rl.close() right before resolving the promise.
    – n8jadams
    Apr 6, 2022 at 19:48
  • In addition, before the promise resolves you probably want process.stdin.removeListener("data", onChar); (this assumes the handler has been extracted into an onChar function.
    – Izhaki
    Jan 24 at 10:28
5

Wanted to add to the marked solution#2.

When we detect the line-ends, I believe we should remove the event handler instead of just stdin.pause(). This can be an issue if you are waiting on rl.question/rl.prompt elsewhere. In those cases, if stdin.pause() was used, it would just exit the program without giving any errors and can be quite annoying to debug.

function hidden(query, callback) {
    var stdin = process.openStdin();
    var onDataHandler = function(char) {
        char = char + "";
        switch (char) {
          case "\n": case "\r": case "\u0004":
            // Remove this handler
            stdin.removeListener("data",onDataHandler); 
            break;//stdin.pause(); break;
          default:
            process.stdout.write("\033[2K\033[200D" + query + Array(rl.line.length+1).join("*"));
          break;
        }
    }
    process.stdin.on("data", onDataHandler);

    rl.question(query, function(value) {
      rl.history = rl.history.slice(1);
      callback(value);
    });
}
3

Also one can use tty.ReadStream
changing mode of process.stdin
to disable echoing input characters.

let read_Line_Str = "";
let credentials_Obj = {};
process.stdin.setEncoding('utf8');
process.stdin.setRawMode( true );
process.stdout.write( "Enter password:" ); 
process.stdin.on( 'readable', () => {
  const chunk = process.stdin.read();
  if ( chunk !== null ) {
    read_Line_Str += chunk;
    if( 
      chunk == "\n" ||
      chunk == "\r" ||
      chunk == "\u0004"
    ){
      process.stdout.write( "\n" );
      process.stdin.setRawMode( false );
      process.stdin.emit('end'); /// <- this invokes on.end
    }else{
      // providing visual feedback
      process.stdout.write( "*" );  
    }  
  }else{
    //console.log( "readable data chunk is null|empty" );
  }
} );
process.stdin.on( 'end', () => {
  credentials_Obj.user = process.env.USER;
  credentials_Obj.host = 'localhost';
  credentials_Obj.database = process.env.USER;
  credentials_Obj.password = read_Line_Str.trim();
  credentials_Obj.port = 5432;
  //
  connect_To_DB( credentials_Obj );
} );
2

A promisified typescript native version:

This will also handle multiple question calls (as @jeffrey-woo pointed out). I chose not to replace input with *, as it didn't feel very unix-y, and I found it to be glitchy sometimes if typing too fast anway.

import readline from 'readline';

export const question = (question: string, options: { hidden?: boolean } = {}) =>
  new Promise<string>((resolve, reject) => {
    const input = process.stdin;
    const output = process.stdout;

    type Rl = readline.Interface & { history: string[] };
    const rl = readline.createInterface({ input, output }) as Rl;

    if (options.hidden) {
      const onDataHandler = (charBuff: Buffer) => {
        const char = charBuff + '';
        switch (char) {
          case '\n':
          case '\r':
          case '\u0004':
            input.removeListener('data', onDataHandler);
            break;
          default:
            output.clearLine(0);
            readline.cursorTo(output, 0);
            output.write(question);
            break;
        }
      };
      input.on('data', onDataHandler);
    }

    rl.question(question, (answer) => {
      if (options.hidden) rl.history = rl.history.slice(1);
      rl.close();
      resolve(answer);
    });
  });

Usage:

(async () => {
  const hiddenValue = await question('This will be hidden', { hidden: true });
  const visibleValue = await question('This will be visible');
  console.log('hidden value', hiddenValue);
  console.log('visible value', visibleValue);
});
1

You can use the prompt module, as suggested here.

const prompt = require('prompt');

const properties = [
    {
        name: 'username', 
        validator: /^[a-zA-Z\s\-]+$/,
        warning: 'Username must be only letters, spaces, or dashes'
    },
    {
        name: 'password',
        hidden: true
    }
];

prompt.start();

prompt.get(properties, function (err, result) {
    if (err) { return onErr(err); }
    console.log('Command-line input received:');
    console.log('  Username: ' + result.username);
    console.log('  Password: ' + result.password);
});

function onErr(err) {
    console.log(err);
    return 1;
}
1
  • I was not able to make this work correctly in an async main function, is this implementation only viable in sequential execution?
    – Huge
    Apr 19, 2021 at 9:31
0

Here's my solution which doesn't require any external libraries (besides readline) or a lot of code.

// turns off echo, but also doesn't process backspaces
// also captures ctrl+c, ctrl+d
process.stdin.setRawMode(true); 

const rl = require('readline').createInterface({input: process.stdin});
rl.on('close', function() { process.exit(0); }); // on ctrl+c, doesn't work? :(
rl.on('line', function(line) {
    if (/\u0003\.test(line)/) process.exit(0); // on ctrl+c, but after return :(
    // process backspaces
    while (/\u007f/.test(line)) {
        line = line.replace(/[^\u007f]\u007f/, '').replace(/^\u007f+/, '');
    }

    // do whatever with line
});
0

Here's my own take on this, cherry picking from the other answers here. When the user types, there is no output. This is to prevent any data leaks.

const readline = require("readline");
    
const hiddenQuestion = (query) =>
    new Promise((resolve) => {
        console.log(query);
        const rl = readline.createInterface({
            input: process.stdin,
            output: process.stdout,
        });
        rl._writeToOutput = () => {};
        const stdin = process.openStdin();
        process.stdin.on("data", (char) => {
            char = char.toString("utf-8");
            switch (char) {
                case "\n":
                case "\r":
                case "\u0004":
                    // Finished writing their response
                    stdin.pause();
                    break;
                // You might make this case optional, (Ctrl-C)
                case "\u0003":
                    // Ctrl-C
                    process.exit(0);
                default:
                    process.stdout.clearLine();
                    readline.cursorTo(process.stdout, 0);
                    break;
            }
        });
        rl.question("", (value) => {
            rl.history = rl.history.slice(1);
            rl.close();
            resolve(value);
        });
    });

// Usage example:
void (async () => {
    const password = await hiddenQuestion("What is your password?");
    // do what you want with the password...
})();
0

Unix like style. No symbols on put/paste at all.

rl.input.on('keypress', (c) => {
  if (c.charCodeAt() === 127) {
    const len = rl.line.length
    readline.moveCursor(rl.output, -len, 0)
    readline.clearLine(rl.output, 1)
    return
  }
  readline.moveCursor(rl.output, -1, 0)
  readline.clearLine(rl.output, 1)
})
0

I liked the _writeToOutput override, but the solutions here don't seem to handle the arrow-up/history case; I've added that, and TypeScripted it. Makes use of the fact that readline sends the full query string when you navigate history, and only a single character normally.

Checking the input or using a proper library are better choices, but not always worth the effort. This ios quick-and-dirty, probably still breaks in cases, but I haven't found them (TM):

let echo = '*';  // or '' if you prefer
let first: string|undefined;

(this.readline as any)._writeToOutput = (c: string) => {
  if (first==undefined || c.length!=1) {
    if (first==undefined) first = c;
    if (c.startsWith(first)) {
      // rewriting prompt
      (this.readline as any).output?.write(first);
      c = c.slice(first.length);
    } else if (!c.trim()) {
      // user pressed enter, show the enter
      (this.readline as any).output?.write(c);
      c = '';
    }
  }
  for (let i = 0; i < c.length; i++) {
    // all other input, and bits after the prompt, use echo char
    (this.readline as any).output?.write(echo);
  }
};

And after completion, don't forget this from https://stackoverflow.com/a/24037546:

(this.readline as any).history = (this.readline as any).history?.slice(1);

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.