$ ps f
31509 pts/3    Ss     0:01 -bash
27266 pts/3    S+     0:00  \_ mysql -uroot -p
25210 pts/10   Ss+    0:00 /bin/bash
24444 pts/4    Ss     0:00 -bash
29111 pts/4    S+     0:00  \_ tmux attach
 4833 pts/5    Ss+    0:00 -bash
 9046 pts/6    Ss     0:00 -bash
17749 pts/6    R+     0:00  \_ ps f
 4748 pts/0    Ss     0:00 -bash
14635 pts/0    T      0:02  \_ mysql -uroot -px xxxxxxxxxxxxxxxx
16210 pts/0    S+     0:01  \_ mysql -uroot -px xxxxxxxxxxxxxxxx

How did ps know to hide the mysql passwords? Can I incorporate this into my own scripts to hide particular CLI attributes?


2 Answers 2


ps does not hide the password. Applications like mysql overwrite arguments list that they got. Please note, that there is a small time frame (possible extendible by high system load), where the arguments are visible to other applications until they are overwritten. Hiding the process to other users could help. In general it is much better to pass passwords via files than per command line.

In this article it is described for C, how to do this. The following example hides/deletes all command line arguments:

#include <string.h>

int main(int argc, char **argv)
    // process command line arguments....

    // hide command line arguments
    if (argc > 1) {
        char *arg_end;    
        arg_end = argv[argc-1] + strlen (argv[argc-1]);
        *arg_end = ' ';

    // ...

Look also at https://stackoverflow.com/questions/724582/hide-arguments-from-ps and https://stackoverflow.com/questions/3830823/hiding-secret-from-command-line-parameter-on-unix .

  • Very nice, thanks. I did not realize that the arguments are mutable as such.
    – dotancohen
    Aug 29, 2013 at 12:01
  • Also note that not all programs will do this with passwords.
    – ash
    Aug 30, 2013 at 6:18
  • The link to this article is broken. Anyone to explain the code for me?(Why the code work, just set \0 to space?) Any link to setproctitle()?
    – schemacs
    Mar 7, 2014 at 16:13
  • Or the answer lies here?
    – schemacs
    Mar 7, 2014 at 16:19

The mysql program replaces the password from the command line with x in this line of code:

while (*argument) *argument++= 'x';     // Destroy argument
  • 4
    Unfortunately, that's not as secure as it could be. You can tell how long the password is. It's better to replace it with \0 so that you need extra information to find the password length (without UB / SEGFAULT).
    – wizzwizz4
    Aug 13, 2017 at 10:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .