title: What is the Purpose of Pydantic's SecretStr?
body: <p>I am learning the <em>Pydantic</em> module, trying to adopt its features/benefits via a toy <a href="https://fastapi.tiangolo.com/" rel="nofollow noreferrer"><em>FastAPI</em></a> web backend as an example implementation.</p>
  <p>I chose to use <a href="https://pydantic-docs.helpmanual.io/usage/types/#secret-types" rel="nofollow noreferrer">Pydantic's <code>SecretStr</code></a> to &quot;hide&quot; passwords. I know it is not really secure, and I am also using <a href="https://passlib.readthedocs.io/en/1.7.2/lib/passlib.context.html?highlight=deprecated" rel="nofollow noreferrer"><code>passlib</code></a> for proper password encryption in DB storage (and using HTTPS for security in transit).</p>
  <p><strong>But this got me thinking: if there is no real security to <code>SecretStr</code>, what is its purpose?</strong></p>
  <p>I don't mean for this to sound inflammatory; Pydantic does not claim that the Secret Types are secure.  The only claim they provide is this:</p>
  <blockquote>
  <p>You can use the <code>SecretStr</code> and the <code>SecretBytes</code> data types for storing sensitive information that you do not want to be visible in logging or tracebacks.</p>
  </blockquote>
  <p>But I do not understand this: how does <code>SecretStr</code> help in hiding logging or tracebacks?  Can't I just make sure not to log the password at all?</p>
  <hr />
  <p><strong>Can someone provide an explanation + example to help me better understand</strong> when and how it can be helpful?  I am struggling to find its real purpose... and if there is no benefit, then it is better to just use an <code>str</code> for the model/schema instead of <code>SecretStr</code>.</p>