I'm currently trying to write a script that has a username & password input which then returns some data if the user has appropriate access. The script works just fine when I hardcode my own credentials in.

The problem I have is that I don't know how to mask password input using the "Add Script" wizard. It appears there is an option to accept an Encrypted String as a parameter, which appears to be what I want, but I can't find any documentation on how to actually utilize the GPEncryptedString class within Python. When I try to extract the parameter with arcpy.getParameterAsText(), it just returns a bunch of asterisks as a string value which obviously does me no good.

I even tried just popping up my own username/password dialog, but scripts have to be ran with the "Always in Foreground" option for the arcpy.mapping.MapDocument("CURRENT") command to work properly, which constantly steals focus from my dialog.

This seems like a really simple problem, but I'm just not finding any documentation anywhere on this issue and I've now spent more time trying to figure out a way to mask password input than I spent on the actual script itself.


As of Version 10.2.1 there is now a String Hidden parameter which masks the text in the UI. This parameter does NOT encrypt. It only hides the characters from the display.

The encrypted string parameter is only for use with tools looking for an encrypted string, such as the Create ArcSDE Connection file tool. If you're passing a "regular" password to something else in your tool (non-esri that wants a password) your only option is String.

We've had internal discussions regarding the creation of a new parameter type, something like "hidden string" which would act like string, but mask the characters in the dialog. However it would send password in clear text behind the scene. At this point thats it, we've only talked about it as there hasn't been a big demand. I'd encourage you to up vote this idea: http://ideas.arcgis.com/ideaView?id=087E00000004GQSIA2

[Disclaimer: I work at Esri on the Geoprocessing Team]

  • That feature would be exactly what I was looking for. That was helpful in that I can stop trying to take the approach of forcing the user to type in their password every time. I'll take some other approach. – arcdrag Mar 20 '13 at 13:55

You probably cannot get the parameter as text. Just call arcpy.GetParameter() which returns an object that is an encrypted string. All the ArcGIS tools like SDE connections should use that encrypted string without issue. If you could get the parameter as text that would defeat the purpose of encrypting it. If you could decrypt it then you could save their password to a file, email it, etc. Have you tried just passing the encrypted string to the rest of the code? According to all the documentation that I have found it should just work. If you need the password as text for another reason, then you should not hide that from your users as it is a security risk at that point because you have the password as plain text.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.