How do I handle password input where characters should not be displayed?

Question

Ryan McCombe · Accepted Answer

Handling password input securely, where characters are not displayed as they're typed, is an important feature for many applications.

In C++, this isn't as straightforward as in some other languages, but we can achieve it using platform-specific functions. Let's explore how to do this on both Windows and Unix-like systems (Linux, macOS).

Windows Implementation

For Windows, we'll use the _getch() function from <conio.h>:

1#include <iostream>
2#include <string>
3#include <conio.h>  // Windows-specific header
4
5std::string getPassword(){
6  std::string password;
7  char ch;
8
9  // Read until Enter is pressed
10  while ((ch = _getch()) != '\r') {
11    // Handle backspace
12    if (ch == '\b') {
13      if (!password.empty()) {
14        std::cout << "\b \b";
15        password.pop_back();
16      }
17    } else {
18      password += ch;
19      std::cout << '*';
20    }
21  }
22  std::cout << '\n';
23  return password;
24}
25
26int main(){
27  std::cout << "Enter password: ";
28  std::string password = getPassword();
29  std::cout << "Password entered: " << password;
30}

This Windows implementation uses _getch() to read characters without echoing them to the console. We print an asterisk for each character entered to provide visual feedback.

1Enter password: ******
2Password entered: secret

Unix-like Systems Implementation

For Unix-like systems, we'll use the termios.h header to modify terminal attributes:

1#include <iostream>
2#include <string>
3#include <termios.h>
4#include <unistd.h>
5
6std::string getPassword(){
7  std::string password;
8  termios oldt;
9  tcgetattr(STDIN_FILENO, &oldt);
10  termios newt = oldt;
11  newt.c_lflag &= ~ECHO;
12  tcsetattr(STDIN_FILENO, TCSANOW, &newt);
13
14  char ch;
15  while ((ch = getchar()) != '\n') {
16    if (ch == 127) {
17      // Handle backspace
18      if (!password.empty()) {
19        std::cout << "\b \b";
20        password.pop_back();
21      }
22    } else {
23      password += ch;
24      std::cout << '*';
25    }
26  }
27  std::cout << '\n';
28
29  tcsetattr(STDIN_FILENO, TCSANOW, &oldt);
30  return password;
31}
32
33int main(){
34  std::cout << "Enter password: ";
35  std::string password = getPassword();
36  std::cout << "Password entered: " << password;
37}

1Enter password: ******
2Password entered: secret

In this Unix-like system implementation, we temporarily disable echo in the terminal, read characters one by one, and restore the original terminal settings afterwards.

Cross-platform Solution

To create a cross-platform solution, you can use conditional compilation:

1#include <iostream>
2#include <string>
3
4#ifdef _WIN32
5#include <conio.h>
6#else
7#include <termios.h>
8#include <unistd.h>
9#endif
10
11std::string getPassword(){
12  std::string password;
13
14#ifdef _WIN32
15  // Windows implementation
16  char ch;
17  while ((ch = _getch()) != '\r') {
18    if (ch == '\b') {
19      if (!password.empty()) {
20        std::cout << "\b \b";
21        password.pop_back();
22      }
23    } else {
24      password += ch;
25      std::cout << '*';
26    }
27  }
28#else
29  // Unix-like implementation
30  termios oldt;
31  tcgetattr(STDIN_FILENO, &oldt);
32  termios newt = oldt;
33  newt.c_lflag &= ~ECHO;
34  tcsetattr(STDIN_FILENO, TCSANOW, &newt);
35
36  char ch;
37  while ((ch = getchar()) != '\n') {
38    if (ch == 127) {
39      if (!password.empty()) {
40        std::cout << "\b \b";
41        password.pop_back();
42      }
43    } else {
44      password += ch;
45      std::cout << '*';
46    }
47  }
48
49  tcsetattr(STDIN_FILENO, TCSANOW, &oldt);
50#endif
51
52  std::cout << '\n';
53  return password;
54}
55
56int main(){
57  std::cout << "Enter password: ";
58  std::string password = getPassword();
59  std::cout << "Password entered: " << password;
60}

1Enter password: ******
2Password entered: secret

This cross-platform solution uses conditional compilation to choose the appropriate implementation based on the target platform.

Remember, while these methods hide password input from the screen, they don't provide complete security. For production systems, consider using secure password hashing algorithms and avoid storing plaintext passwords.

User Input in the Terminal

Secure Password Input in C++

Windows Implementation

Unix-like Systems Implementation

Cross-platform Solution

User Input in the Terminal

Intro to C++ Programming

Questions & Answers