I use shells running under Emacs (via M-x shell) under a variety of settings1.

In all these settings, I use the same .emacs file. Nevertheless I observe an inconsistency, as described below.

In some settings, when I run a command that requires a password (e.g. ssh) from such a shell session, the command's prompt for the password will appear in the mini-buffer, and the password itself will be hidden (as the user types, all that appears on the screen are dots).

In other settings, however, the same command will result in a prompt that appears in the main shell-interaction buffer (as opposed to the mini-buffer), and the password typed by the user will be visible.

Does anyone know what governs whether Emacs will hide passwords in such situations or not?

1 I use the term "setting" to capture a wide number of factors, including the version of Emacs, the underlying OS, whether or not Emacs is running through ssh, whether or not Emacs is running in text-only mode, and if so, the terminal emulator, whether or not Emacs is running under gnu-screen, etc.

  • 3
    Probably, in one case the password prompt matches comint-password-prompt-regexp and in the other it does not. Are you sure it's the same command? Check the password prompt carefully.
    – NickD
    Feb 27, 2023 at 22:22
  • 1
    @NickD: Your guess is a good one. Thank you! Even though the command (as I type it) is the same across the different settings, it turns out that the password prompts they generate vary in format from one situation to another. E.g. in one setting, ssh produces the prompt Password for [email protected]:, and in another it produces the prompt ([email protected]) Password:. I'd be happy to accept your comment as the answer, if you post it as such.
    – kjo
    Feb 27, 2023 at 22:59
  • 1
    Posted an answer expanding on the comment.
    – NickD
    Feb 28, 2023 at 1:47

1 Answer 1


comint uses a regular expression to recognize password prompts: comint-password-prompt-regexp. It's fairly complicated in an attempt to catch as many variations as possible, but it is conceivable (and it happened apparently in this case), that the password prompts are slightly different: one matches the regexp, so the password is asked for in the minibuffer and is hidden, but the other does not match so the password is asked for as if there is nothing special and comint does not hide it.

So the solution is to either somehow make the password prompts similar enough so that they both match the regexp or to enhance the regexp so that it matches all the different prompts that you are interested in.

Do C-h v comint-password-prompt-regexp and click on the comint.el link to take you to the definition. The comment before it is indicative of the kind of madness that this regexp has to accommodate:

;; kinit prints a prompt like `Password for [email protected]: '.
;; ksu prints a prompt like `Kerberos password for devnull/[email protected]: '.
;; ssh-add prints a prompt like `Enter passphrase: '.
;; plink prints a prompt like `Passphrase for key "[email protected]": '.
;; Ubuntu's sudo prompts like `[sudo] password for user:'
;; Some implementations of passwd use "Password (again)" as the 2nd prompt.
;; Something called "perforce" uses "Enter password:".
;; OpenVPN prints a prompt like: "Enter Auth Password:".
;; OpenBSD doas prints "doas (user@host) password:".
;; See ert test `comint-test-password-regexp'.

The regexp is complicated so it's not easy to change correctly. Be careful!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.