Read a secret from stdin

A script needs a password, and taking it as an argument leaves it in ps and the shell history.

printf 'hunter2\n' | {
  IFS= read -rs -p 'Password: ' pw
  echo "read ${#pw} characters"
  bash -c 'echo "child sees: ${pw-nothing}"'
}

read 7 characters
child sees: nothing

read -s turns off terminal echo while the value is typed, -r keeps backslashes and an empty IFS keeps leading and trailing spaces. The value lives in a shell variable that is not exported, so the child process printed nothing and no other program can read it from its environment. The options are in the Bash manual. Since the text never appears in a command line, it stays out of ps and out of the history.

-s only works on a terminal and -p prints its prompt only when the input is a terminal, so the piped test above shows no prompt. Unset the variable as soon as it is used, and do not pass it to a command with -p on the command line. A secret in a variable can still appear in a core dump or in set -x output, so turn tracing off around it.