Add optional argument mask for getpass.getpass

Author: donbarbos

Doc/library/getpass.rst

@@ -16,7 +16,7 @@
 
 The :mod:`getpass` module provides two functions:
 
-.. function:: getpass(prompt='Password: ', stream=None)
+.. function:: getpass(prompt='Password: ', stream=None, mask=None)
 
    Prompt the user for a password without echoing.  The user is prompted using
    the string *prompt*, which defaults to ``'Password: '``.  On Unix, the
@@ -25,6 +25,11 @@ The :mod:`getpass` module provides two functions:
    (:file:`/dev/tty`) or if that is unavailable to ``sys.stderr`` (this
    argument is ignored on Windows).
 
+   The *mask* argument controls how user input is displayed while typing. If
+   *mask* is ``None`` (default), input remains hidden. If *mask* is a string,
+   each typed character is replaced with the given string. For example,
+   ``mask='*'`` will display asterisks instead of the actual input.
+
    If echo free input is unavailable getpass() falls back to printing
    a warning message to *stream* and reading from ``sys.stdin`` and
    issuing a :exc:`GetPassWarning`.

Doc/whatsnew/3.14.rst

@@ -558,6 +558,14 @@ getopt
 * Add support for returning intermixed options and non-option arguments in order.
   (Contributed by Serhiy Storchaka in :gh:`126390`.)
 
+
+getpass
+-------
+
+* Add optional argument *mask* for :meth:`getpass.getpass`.
+  (Contributed by Semyon Moroz in :gh:`77065`.)
+
+
 http
 ----
 

Lib/getpass.py

@@ -1,6 +1,7 @@
 """Utilities to get a password and/or the current user name.
 
-getpass(prompt[, stream]) - Prompt for a password, with echo turned off.
+getpass(prompt[, stream[, mask]]) - Prompt for a password, with echo
+turned off.
 getuser() - Get the user name from the environment or password database.
 
 GetPassWarning - This UserWarning is issued when getpass() cannot prevent
@@ -25,13 +26,14 @@
 class GetPassWarning(UserWarning): pass
 
 
-def unix_getpass(prompt='Password: ', stream=None):
+def unix_getpass(prompt='Password: ', stream=None, mask=None):
     """Prompt for a password, with echo turned off.
 
     Args:
       prompt: Written on stream to ask for the input.  Default: 'Password: '
       stream: A writable file object to display the prompt.  Defaults to
               the tty.  If no tty is available defaults to sys.stderr.
+      mask: A string used to mask input (e.g., '*'). If None, input is hidden.
     Returns:
       The seKr3t input.
     Raises:
@@ -40,7 +42,7 @@ def unix_getpass(prompt='Password: ', stream=None):
 
     Always restores terminal settings before returning.
     """
-    passwd = None
+    passwd = ""
     with contextlib.ExitStack() as stack:
         try:
             # Always try reading and writing directly on the tty first.
@@ -68,17 +70,41 @@ def unix_getpass(prompt='Password: ', stream=None):
                 old = termios.tcgetattr(fd)     # a copy to save
                 new = old[:]
                 new[3] &= ~termios.ECHO  # 3 == 'lflags'
+                if mask:
+                    new[3] &= ~termios.ICANON
                 tcsetattr_flags = termios.TCSAFLUSH
                 if hasattr(termios, 'TCSASOFT'):
                     tcsetattr_flags |= termios.TCSASOFT
                 try:
                     termios.tcsetattr(fd, tcsetattr_flags, new)
-                    passwd = _raw_input(prompt, stream, input=input)
+                    if not mask:
+                        passwd = _raw_input(prompt, stream, input=input)
+                        stream.write('\n')
+                        return passwd
+
+                    stream.write(prompt)
+                    stream.flush()
+                    while True:
+                        char = input.read(1)
+                        if char == '\n' or char == '\r':
+                            break
+                        if char == '\x03':
+                            raise KeyboardInterrupt
+                        if char == '\x7f' or char == '\b':
+                            if mask and passwd:
+                                stream.write("\b \b" * len(mask))
+                                stream.flush()
+                            passwd = passwd[:-1]
+                        else:
+                            passwd += char
+                            if mask:
+                                stream.write(mask)
+                                stream.flush()
                 finally:
                     termios.tcsetattr(fd, tcsetattr_flags, old)
                     stream.flush()  # issue7208
             except termios.error:
-                if passwd is not None:
+                if passwd:
                     # _raw_input succeeded.  The final tcsetattr failed.  Reraise
                     # instead of leaving the terminal in an unknown state.
                     raise
@@ -93,7 +119,7 @@ def unix_getpass(prompt='Password: ', stream=None):
         return passwd
 
 
-def win_getpass(prompt='Password: ', stream=None):
+def win_getpass(prompt='Password: ', stream=None, mask=None):
     """Prompt for password with echo off, using Windows getwch()."""
     if sys.stdin is not sys.__stdin__:
         return fallback_getpass(prompt, stream)
@@ -108,9 +134,16 @@ def win_getpass(prompt='Password: ', stream=None):
         if c == '\003':
             raise KeyboardInterrupt
         if c == '\b':
+            if mask and pw:
+                for _ in range(len(mask)):
+                    msvcrt.putwch('\b')
+                    msvcrt.putwch(' ')
+                    msvcrt.putwch('\b')
             pw = pw[:-1]
         else:
             pw = pw + c
+            if mask:
+                msvcrt.putwch(mask)
     msvcrt.putwch('\r')
     msvcrt.putwch('\n')
     return pw

Misc/NEWS.d/next/Library/2025-02-24-07-08-11.gh-issue-77065.8uW0Wf.rst

@@ -0,0 +1,2 @@
+Added optional argument *mask* for :meth:`getpass.getpass`. Patch by
+Semyon Moroz.