Struct SecretString 

pub struct SecretString(/* private fields */);

An owned, zeroizing wrapper around a String.

The backing allocation is zeroized on Drop. Debug is redacted. [Display] is not implemented to prevent accidental formatting. Clone produces an independently owned, independently zeroized copy.

Implementations

impl SecretString

pub const fn new(value: String) -> Self

Wraps an owned String as a secret.

pub fn expose_secret(&self) -> &str

Borrows the secret as a &str for use without taking ownership.

All uses of this function should be carefully reviewed to ensure the value is not printed or copied to a non-Secret-wrapped storage. The borrow does not change ownership and the secret is still zeroed on drop.

pub const fn len(&self) -> usize

Length of the secret in bytes.

pub const fn is_empty(&self) -> bool

Whether the secret is empty.

pub fn into_string(self) -> String

Consumes the wrapper and returns the plain owned String.

This is the ownership-handoff path for when a secret must leave the library boundary. The moved-out value is not zeroized (that is the point of handoff); the caller then owns leak prevention. No wrapped copy remains, because self is consumed by value.

Trait Implementations

impl Clone for SecretString

fn clone(&self) -> SecretString

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretString

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for SecretString

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl From<String> for SecretString

fn from(value: String) -> Self

Converts to this type from the input type.

impl Zeroize for SecretString

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.