I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
Verify Feature Scope
I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.
Problem Description
When creating Tools or Functions with UserValves that contain sensitive fields like passwords, the password is displayed as plain text in the OpenWebUI settings UI.
This is a security concern because:
Passwords are visible on screen (shoulder surfing risk)
Passwords may be visible in screenshots
Users expect password fields to be masked in settings forms
Current Behavior:
The standard JSON Schema format: "password" attribute is not recognized by the Valves.svelte component.
classUserValves(BaseModel):exchange_password:str=Field(default="",description="Your Exchange/AD password",json_schema_extra={"format":"password"}# <-- Currently IGNORED by the UI)
Desired Solution you'd like
Support the standard JSON Schema format: "password" attribute in Valves.svelte to render sensitive fields as password inputs (masked with dots).
OpenWebUI already has a SensitiveInput.svelte component. I propose modifying src/lib/components/common/Valves.svelte to use this existing component when the format is detected.
Implementation Logic:
Inside the valves rendering loop:
Check if valvesSpec.properties[property]?.format === 'password'
If true, render <SensitiveInput ... /> instead of the default <input type="text"> or <textarea>.
Alternatives Considered
Using "api_key" naming convention: We considered naming fields api_key to hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords).
Custom HTML in Description: Not supported/sanitized.
Doing nothing: Leaves credentials exposed in the UI.
Additional Context
Implementation Suggestion:
In src/lib/components/common/Valves.svelte, add this condition to the main rendering loop:
✅Standard: Uses standard Pydantic/JSON Schema format: "password".
✅Easy: Low-effort change leveraging the existing content.
For Tool Developers:
They can simply add json_schema_extra={"format": "password"} to their Pydantic models.
Originally created by @EliasBA on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20852
### Check Existing Issues
- [x] I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request.
### Verify Feature Scope
- [x] I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.
### Problem Description
When creating Tools or Functions with `UserValves` that contain sensitive fields like passwords, the password is displayed as **plain text** in the OpenWebUI settings UI.
This is a security concern because:
- Passwords are visible on screen (shoulder surfing risk)
- Passwords may be visible in screenshots
- Users expect password fields to be masked in settings forms
**Current Behavior:**
The standard JSON Schema `format: "password"` attribute is **not recognized** by the `Valves.svelte` component.
```python
class UserValves(BaseModel):
exchange_password: str = Field(
default="",
description="Your Exchange/AD password",
json_schema_extra={"format": "password"} # <-- Currently IGNORED by the UI
)
```
### Desired Solution you'd like
Support the standard JSON Schema `format: "password"` attribute in `Valves.svelte` to render sensitive fields as password inputs (masked with dots).
OpenWebUI already has a `SensitiveInput.svelte` component. I propose modifying `src/lib/components/common/Valves.svelte` to use this existing component when the format is detected.
**Implementation Logic:**
Inside the valves rendering loop:
1. Check if `valvesSpec.properties[property]?.format === 'password'`
2. If true, render `<SensitiveInput ... />` instead of the default `<input type="text">` or `<textarea>`.
### Alternatives Considered
- **Using "api_key" naming convention:** We considered naming fields `api_key` to hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords).
- **Custom HTML in Description:** Not supported/sanitized.
- **Doing nothing:** Leaves credentials exposed in the UI.
### Additional Context
**Implementation Suggestion:**
In `src/lib/components/common/Valves.svelte`, add this condition to the main rendering loop:
```svelte
{:else if valvesSpec.properties[property]?.format === 'password'}
<SensitiveInput
placeholder={valvesSpec.properties[property]?.description ?? ''}
bind:value={valves[property]}
/>
```
**Benefits:**
- ✅ **Security:** Passwords hidden from view by default.
- ✅ **Standard:** Uses standard Pydantic/JSON Schema `format: "password"`.
- ✅ **Easy:** Low-effort change leveraging the existing content.
**For Tool Developers:**
They can simply add `json_schema_extra={"format": "password"}` to their Pydantic models.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @EliasBA on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20852
Check Existing Issues
Verify Feature Scope
Problem Description
When creating Tools or Functions with
UserValvesthat contain sensitive fields like passwords, the password is displayed as plain text in the OpenWebUI settings UI.This is a security concern because:
Current Behavior:
The standard JSON Schema
format: "password"attribute is not recognized by theValves.sveltecomponent.Desired Solution you'd like
Support the standard JSON Schema
format: "password"attribute inValves.svelteto render sensitive fields as password inputs (masked with dots).OpenWebUI already has a
SensitiveInput.sveltecomponent. I propose modifyingsrc/lib/components/common/Valves.svelteto use this existing component when the format is detected.Implementation Logic:
Inside the valves rendering loop:
valvesSpec.properties[property]?.format === 'password'<SensitiveInput ... />instead of the default<input type="text">or<textarea>.Alternatives Considered
api_keyto hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords).Additional Context
Implementation Suggestion:
In
src/lib/components/common/Valves.svelte, add this condition to the main rendering loop:Benefits:
format: "password".For Tool Developers:
They can simply add
json_schema_extra={"format": "password"}to their Pydantic models.@tjbck commented on GitHub (Jan 21, 2026):
Addressed with
8c70453b2ein dev!