Introduced in Tiki31

This field type stores sensitive values such as API keys, credentials, and tokens.
The value is masked in the user interface and is never inlined in the rendered HTML: both edit and view modes display a masked placeholder, and the real value is fetched on demand over a POST request when the user clicks the reveal (eye) button.
Secret field values are excluded from the unified search index.

For team password management with encryption, the Secret field integrates with Shared Secrets (Shamir's Shared Secret) encryption keys.

• Edit mode renders a masked password input with a show/hide (eye) toggle. The browser is instructed not to autofill it (autocomplete="new-password").
• View mode shows ●●●●●● with a reveal button. The actual value is fetched on demand and never appears in the page source, browser history, or proxy logs.
• Values are excluded from the unified search index, so secrets can never leak through search results.
• When a Shared Secrets encryption key is assigned to the field, the value is stored encrypted. It can only be revealed after the key has been unlocked in the current session.
• Submitting the form with the field left empty keeps the stored value. This protects against accidental wipes when editing other fields of an item.

From the tracker administration page, click Add Field and select Secret Field in the field type selector.

Click to expand

When creating or editing a tracker item, the Secret field renders as a masked input with an eye button.

Click to expand

• On a new item, the eye button simply toggles between masked and visible text.
• On an existing item that already stores a value, the input shows a "Value stored" placeholder. The first click on the eye button fetches the stored value from the server, then the button toggles visibility locally.
• Leaving the field empty and saving keeps the previously stored value.

Click to expand

When viewing a tracker item, the Secret field always displays six bullets, regardless of the stored value length, together with a reveal button.

Click to expand

Clicking the reveal button fetches the value and displays it. Clicking again masks it.

Click to expand

To store the value encrypted, assign an encryption key to the field: "Advanced Options" > "Advanced" tab > "Encryption key".
See Shared Secrets for how to create and distribute encryption keys.

When an encryption key is assigned:

• The value is encrypted before being written to the database.
• The field stays locked until the user unlocks the encryption key in the current session.
• The reveal button only works once the key is unlocked. Before that, the server refuses to serve the value (HTTP 403).

• The plaintext value never appears in the rendered HTML. It travels only in the response of an on-demand POST request.
• The retrieval endpoint only serves Secret fields. It cannot be used to read any other field type.
• Field-level view permissions (including item-level visibility) are enforced on the server for every retrieval request.
• For encrypted fields, the server checks that the encryption key is accessible in the current session before decrypting.

• Tracker Field Types
• Trackers
• Shared Secrets
• User Encryption
• Text Tracker Field