My terminal was showing passwords in plain text, and I felt sick.

Sensitive data spilling across the screen is a quiet disaster. It happens fast. Debug a script, echo a command, print an environment variable — and suddenly secrets are sitting in scrollback history. Once they’re exposed, you lose control.

Masking sensitive data in Zsh is not a nice-to-have. It’s an immediate, zero-excuse requirement. The good news: Zsh makes it possible to shield secrets before they leak.

Why Sensitive Data Leaks in Zsh

Zsh scripts and commands often echo $ENV variables to logs or terminals. API keys, tokens, passwords, database strings — all are vulnerable when printed. History expansion in Zsh stores full commands unless told otherwise. Third-party tools can output raw data without sanitizing it. One careless command can drop a secret into bash history, system logs, or a screenshot.

The Core Fix: Mask Before Output

The principle is simple: never let secrets leave memory in readable form. In Zsh, you can intercept variables before printing, replace them with masked versions, and scrub them from history. For example:

mask_secret() {
 echo "${1:0:4}****${1: -4}"
}

export API_KEY="sk_live_1234567890abcdef"
echo "Using API key: $(mask_secret "$API_KEY")"

This masks all but the first and last four characters. The key never appears in full in any output.

Suppressing History and Logs

Even masked outputs can cause trouble if you don't control shell history. Use:

setopt HIST_IGNORE_SPACE

Then start sensitive commands with a space so they don't get logged. For absolutely critical cases:

unset HISTFILE

This kills command logging entirely for the current session.

Auto-Masking via Preexec and Precmd

Zsh offers preexec and precmd hooks to intercept commands before they run and before prompts show. You can scan for patterns like keys or tokens and automatically replace them with safe placeholders before they hit the screen or logs:

preexec() {
 BUFFER=$(echo "$BUFFER"| sed 's/sk_live_[A-Za-z0-9]*/sk_live_********/g')
}

This approach gives you a safety net across your session, catching sensitive data even if you forget to mask manually.

Environment Hygiene

Don’t keep unused secrets loaded. Unset variables after use:

unset API_KEY

Replace secrets with temporary session-specific tokens wherever possible. And encrypt files containing credentials instead of leaving them in plaintext.

Test Your Setup

Run controlled tests by setting dummy API keys and running your common workflows. Watch both your terminal output and your shell history to confirm secrets never appear in full. Add masking checks to CI to prevent regressions.

Continuous Protection

Masking sensitive data in Zsh is not just about safer scripts. It’s about building a practice where no environment variable, no debug log, and no command history can betray you. The goal is fast feedback without risk.

It’s possible to see this live in minutes. hoop.dev lets you hook into real environments, run commands, and keep sensitive data invisible in real time. Set it up now, and turn a potential nightmare into just another solved problem.