So lets say I have a .sh script and I have to input a password in it , will there be some kind of cache where the bash inputs are stored ? And if yes please tell me whre so I can ersase it . Would the attacker be able to decrypt something which was encrypted with a shell / bash script passed through another program , if he had physical access to the machine ? If yes , how can I prevent that ?

I didnt find anything on the topic .

Thank you !

part of the script as example :

echo "please input your password to be hashed "
echo ""

stty -echo
read -p "Password :" x; echo
stty echo 

echo ""

echo "please repeat the password "

echo ""
stty -echo
read -p "Password :" x2; echo
stty echo

if [[ $x == $x2 ]] ;then 
    echo ""
    echo "Passwords match !"
    echo ""
    sleep 2
    echo ""
    echo "passwords dont match :( "
    echo ""
    sleep 2
    echo "exiting"
    echo ""
    sleep 1
    exit 1 
  • Your password will be in the memory and you cannot modify the memory like that
    – Florian
    Commented Jul 16, 2017 at 1:58
  • Please more datail Commented Jul 16, 2017 at 3:07
  • @Florian. Talking about memory thing is beyond the scope of this question. Yes, it is required to protect memory for best security.. but that is another case for example if someone has gained access into the physical hardware. The OP does not need to know this in details but if you know how to decrypt that, then share here.
    – MaXi32
    Commented Sep 3, 2021 at 5:39

2 Answers 2



  1. Don't reinvent the wheel

    There could already exist some tool for doing what you need.

  2. Check your history files

    grep mycommand .*history
  3. Don't use command line arguments or environment variables to store sensitive data (like passwords)!

    Always use files or fd (file descriptors)! Try

    ps axefwww

    to read all command lines and environment, currently running on your host

From openssl's man page:

(where sensible datas as command line argument or environment variables are recommended to be used where security is not important and with caution)

   Pass Phrase Options
       Several commands accept password arguments, typically using -passin and
       -passout for input and output passwords respectively. These allow the
       password to be obtained from a variety of sources. Both of these
       options take a single argument whose format is described below. If no
       password argument is given and a password is required then the user is
       prompted to enter one: this will typically be read from the current
       terminal with echoing turned off.

           The actual password is password. Since the password is visible to
           utilities (like 'ps' under Unix) this form should only be used
           where security is not important.

           Obtain the password from the environment variable var. Since the
           environment of other processes is visible on certain platforms
           (e.g. ps under certain Unix OSes) this option should be used with

           The first line of pathname is the password. If the same pathname
           argument is supplied to -passin and -passout arguments then the
           first line will be used for the input password and the next line
           for the output password. pathname need not refer to a regular file:
           it could for example refer to a device or named pipe.

           Read the password from the file descriptor number. This can be used
           to send the data via a pipe for example.

           Read the password from standard input.

Little sample


umask 077
TEMPDIR=$(mktemp -d -p "$HOME" .secretXXXXXXXX)
trap "rm -fR '$TEMPDIR';exit" 0 1 2 3 6 9 15
[ "$TEMPDIR" ] || exit 1
cd "$TEMPDIR" || exit 1

ostty=$(stty -g)
stty -echo

printf "\nEnter password: "
head -n1 >pass1

printf "\nRe-enter password: "
head -n1 >pass2

stty $ostty

chk1=$(sha1sum <pass1)
chk2=$(sha1sum <pass2)

[ "$chk1" = "$chk2" ] || {
    echo "password doesn't match"
    exit 1

openssl DoSomeThingWith -passin file:pass1
  • bash / shell scripts can are made to interact with so many OS functions . at some point you cant avoid in / outputing sensitive data . there has to be a way to be a way to erase it . Commented Jul 16, 2017 at 12:10
  • Command read could use history files but you have to use -i flag. Commented Jul 17, 2017 at 12:02
  • but care when you use environment variables (like $x2), how you pass them to next crypto tool! Commented Jul 17, 2017 at 12:04

The cache you're worried about would be your shell history. I typically use bash, and can see its history by typing "history" in the command line:


I can clear it with the following:

history -c

Every user has their own history. If you didn't erase it, then it is plausible for an attacker to see it if they somehow gain access to your account.

Your question regarding decryption requires a lot more detail about exactly how the script works to do encryption: one simple answer is if the attacker had the encryption key then, yes he can decrypt it. Is the encryption key the password you're referring to? If so, then ensuring the password is not captured in your shell history is indeed a good precaution to take.

However, there is a concern about the script to begin with. For interactive human users, it should not accept the password as a script parameter - instead when the program runs, it should prompt you for the password. This way the password will never be accidentally left as part of the shell history.

Having said that there may be scenarios when an encryption script is used by other scripts, in which case then the encryption script would need to be able to accept the password/key as a script parameter. The issue of security would be to ensure that these other scripts to have the appropriate file permissions to ensure the embedded password/key is not revealed to other parties.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .