Credential masking is a security control that hides secrets such as passwords, API keys, session tokens, and private certificates from places where they should not appear, including logs, chat transcripts, prompts, browser history, and model context. Instead of exposing the raw value, the system may show a placeholder or request the secret through a protected channel.
This matters because secrets are often the fastest path from a small mistake to a major compromise. In attacks, leaked credentials can be copied from debug output, prompt traces, or shared session logs and reused for lateral movement, account takeover, or API abuse. In defenses, masking reduces accidental disclosure and limits what an AI agent, operator, or attacker can see if a transcript is captured. It works best with least privilege, short-lived tokens, and strict separation between trusted control paths and untrusted text handling.