Struct SecretBuffer 

pub struct SecretBuffer { /* private fields */ }

Owned sensitive bytes with redacted formatting and drop-time cleanup.

SecretBuffer is available with the alloc feature. It is intended for decoded keys, tokens, and other values that should not be accidentally logged. The buffer exposes contents only through explicit reveal methods.

Spare vector capacity is cleared when wrapping owned bytes. On drop, initialized bytes and vector spare capacity are cleared with the crate’s internal best-effort wipe helpers. This is data-retention reduction, not a formal zeroization guarantee, and it cannot make claims about allocator behavior or historical copies outside the wrapper.

Implementations

impl SecretBuffer

pub fn from_vec(bytes: Vec<u8>) -> Self

Wraps an existing vector as sensitive material.

pub fn from_slice(bytes: &[u8]) -> Self

Copies a slice into an owned sensitive buffer.

pub fn len(&self) -> usize

Returns the number of initialized secret bytes.

pub fn is_empty(&self) -> bool

Returns whether the buffer contains no initialized secret bytes.

pub fn expose_secret(&self) -> &[u8]

Reveals the secret bytes.

This method is intentionally named to make secret access explicit at the call site.

pub fn expose_secret_utf8(&self) -> Result<&str, Utf8Error>

Reveals the secret bytes as UTF-8 text.

This method is intentionally named to make secret access explicit at the call site. Secret material may be arbitrary binary data, so this method is fallible.

pub fn expose_secret_mut(&mut self) -> &mut [u8]

Reveals the secret bytes mutably.

This method is intentionally named to make secret access explicit at the call site.

pub fn into_exposed_vec(self) -> Vec<u8>

Consumes the wrapper and returns the owned secret bytes.

This is an explicit escape hatch for interop with APIs that require an owned vector. The returned Vec<u8> is no longer redacted by formatting and will not be cleared by SecretBuffer on drop; callers that keep handling sensitive data should arrange their own cleanup.

pub fn try_into_exposed_string(self) -> Result<String, Self>

Consumes the wrapper and returns the owned secret bytes as UTF-8 text.

This is an explicit escape hatch for interop with APIs that require an owned string. The returned String is no longer redacted by formatting and will not be cleared by SecretBuffer on drop; callers that keep handling sensitive data should arrange their own cleanup.

If the secret bytes are not valid UTF-8, the original redacted wrapper is returned unchanged.

pub fn constant_time_eq(&self, other: &[u8]) -> bool

Compares this secret to other without short-circuiting on the first differing byte.

Length and the final equality result remain public. For equal-length inputs, this helper scans every byte before returning. It is constant-time-oriented best effort, not a formal cryptographic constant-time guarantee.

pub fn clear(&mut self)

Clears the initialized bytes and makes the buffer empty.

Trait Implementations

impl Clone for SecretBuffer

Available on crate feature alloc only.

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretBuffer

Available on crate feature alloc only.

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SecretBuffer

Available on crate feature alloc only.

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for SecretBuffer

Available on crate feature alloc only.

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<const CAP: usize> From<DecodedBuffer<CAP>> for SecretBuffer

Available on crate feature alloc only.

fn from(buffer: DecodedBuffer<CAP>) -> Self

Copies visible decoded bytes from a stack-backed buffer into an owned redacted buffer.

The consumed stack-backed buffer clears its backing array when it is dropped at the end of the conversion.

impl<const CAP: usize> From<EncodedBuffer<CAP>> for SecretBuffer

Available on crate feature alloc only.

fn from(buffer: EncodedBuffer<CAP>) -> Self

Copies visible encoded bytes from a stack-backed buffer into an owned redacted buffer.

The consumed stack-backed buffer clears its backing array when it is dropped at the end of the conversion.

impl From<String> for SecretBuffer

Available on crate feature alloc only.

fn from(text: String) -> Self

Wraps an owned UTF-8 string as sensitive material.

The string is consumed without copying its initialized bytes. Spare vector capacity is cleared immediately before the bytes are stored.

impl From<Vec<u8>> for SecretBuffer

Available on crate feature alloc only.

fn from(bytes: Vec<u8>) -> Self

Wraps an owned vector as sensitive material.

Spare capacity is cleared immediately before the vector is stored. Use SecretBuffer::from_slice when the source data is borrowed.

impl PartialEq<&[u8]> for SecretBuffer

Available on crate feature alloc only.

fn eq(&self, other: &&[u8]) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<const N: usize> PartialEq<&[u8; N]> for SecretBuffer

Available on crate feature alloc only.

fn eq(&self, other: &&[u8; N]) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<&str> for SecretBuffer

Available on crate feature alloc only.

fn eq(&self, other: &&str) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<SecretBuffer> for &[u8]

Available on crate feature alloc only.

fn eq(&self, other: &SecretBuffer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<const N: usize> PartialEq<SecretBuffer> for &[u8; N]

Available on crate feature alloc only.

fn eq(&self, other: &SecretBuffer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<SecretBuffer> for &str

Available on crate feature alloc only.

fn eq(&self, other: &SecretBuffer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<SecretBuffer> for String

Available on crate feature alloc only.

fn eq(&self, other: &SecretBuffer) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq<String> for SecretBuffer

Available on crate feature alloc only.

fn eq(&self, other: &String) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialEq for SecretBuffer

Available on crate feature alloc only.

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<&[u8]> for SecretBuffer

Available on crate feature alloc only.

fn try_from(input: &[u8]) -> Result<Self, Self::Error>

Decodes strict standard padded Base64 into a redacted owned buffer.

Use Engine::decode_secret or Profile::decode_secret when a different alphabet, padding mode, or line-wrapping profile is required.

type Error = DecodeError

The type returned in the event of a conversion error.

impl TryFrom<&str> for SecretBuffer

Available on crate feature alloc only.

fn try_from(input: &str) -> Result<Self, Self::Error>

Decodes strict standard padded Base64 text into a redacted owned buffer.

Use Engine::decode_secret or Profile::decode_secret when a different alphabet, padding mode, or line-wrapping profile is required.

type Error = DecodeError

The type returned in the event of a conversion error.

impl Eq for SecretBuffer

Available on crate feature alloc only.