Secret Tracker Field
Introduced in Tiki31
This field type stores sensitive values such as API keys, credentials, and tokens.
The value is masked in the user interface and is never inlined in the rendered HTML: both edit and view modes display a masked placeholder, and the real value is fetched on demand over a POST request when the user clicks the reveal (eye) button.
Secret field values are excluded from the unified search index.
For team password management with encryption, the Secret field integrates with Shared Secrets (Shamir's Shared Secret) encryption keys.
Overview
- Edit mode renders a masked password input with a show/hide (eye) toggle. The browser is instructed not to autofill it (autocomplete="new-password").
- View mode shows ●●●●●● with a reveal button. The actual value is fetched on demand and never appears in the page source, browser history, or proxy logs.
- Values are excluded from the unified search index, so secrets can never leak through search results.
- When a Shared Secrets encryption key is assigned to the field, the value is stored encrypted. It can only be revealed after the key has been unlocked in the current session.
- Submitting the form with the field left empty keeps the stored value. This protects against accidental wipes when editing other fields of an item.
To Access
From the tracker administration page, click Add Field and select Secret Field in the field type selector.
Parameters
| Parameter | value | description | version |
| max | numeric | Maximum number of characters allowed. 0 means unlimited. | tw>=31 |
Using the field
Edit mode
When creating or editing a tracker item, the Secret field renders as a masked input with an eye button.
- On a new item, the eye button simply toggles between masked and visible text.
- On an existing item that already stores a value, the input shows a "Value stored" placeholder. The first click on the eye button fetches the stored value from the server, then the button toggles visibility locally.
- Leaving the field empty and saving keeps the previously stored value.
View mode
When viewing a tracker item, the Secret field always displays six bullets, regardless of the stored value length, together with a reveal button.
Clicking the reveal button fetches the value and displays it. Clicking again masks it.
With encryption (Shared Secrets)
To store the value encrypted, assign an encryption key to the field: "Advanced Options" > "Advanced" tab > "Encryption key".
See Shared Secrets for how to create and distribute encryption keys.
When an encryption key is assigned:
- The value is encrypted before being written to the database.
- The field stays locked until the user unlocks the encryption key in the current session.
- The reveal button only works once the key is unlocked. Before that, the server refuses to serve the value (HTTP 403).
Security model
- The plaintext value never appears in the rendered HTML. It travels only in the response of an on-demand POST request.
- The retrieval endpoint only serves Secret fields. It cannot be used to read any other field type.
- Field-level view permissions (including item-level visibility) are enforced on the server for every retrieval request.
- For encrypted fields, the server checks that the encryption key is accessible in the current session before decrypting.
Tracker synchronization transfers secrets in plaintext. When using Tracker Synchronization between Tiki instances, Secret field values are transferred unmasked. Deployments syncing trackers between instances should account for this in their threat model.
Clearing a stored value: an empty submission deliberately preserves the existing value, so editing other fields never wipes a secret by accident. To remove a value on purpose, use the Clear stored value checkbox in edit mode. It acts on the single item being edited, never on other items in the tracker.