Show keys in a recording without leaking a password
A key display cannot show a password it never sees, and on a Mac most password fields make sure of that. When a password field has focus, macOS turns on secure input, which keeps the keys you press away from other apps. Typebar then shows nothing you type, and its pill says typing is hidden, for example “Typing hidden in a password field”. The real risk is everywhere that is not a proper password field, so most of this is about those places and about checking a recording before it goes out.
What secure input does
Secure input is a macOS feature for password entry. While it is on, your keystrokes go to the app you are typing in, and apps that watch the keyboard, key displays included, do not get them. It comes on when a standard password field has focus: the password prompts macOS itself shows, the password fields in most Mac apps, and the password boxes on web pages in Safari and other common browsers. It goes off when you leave the field.
For a key display this is the safest design there is. The protection does not depend on the overlay behaving well, because macOS never hands it the keys. In Typebar the pill says why it has gone quiet while secure input lasts, so you can see the protection working while you record.
Two things are worth knowing about it:
- Some apps can turn it on for everything. Terminal has Secure Keyboard Entry in its Terminal menu. While it is on, no key display sees what you type in Terminal, which protects passwords and also blanks out a terminal tutorial. Secure input on a Mac: why some apps go blank to key displays explains the details.
- It protects the keys, not the screen. A field that shows the password in plain text, through a “Show password” checkbox or an eye icon, shows it to the recording too.
Where a password can still slip out
Most leaks happen when a password goes somewhere that is not a password field, or when the screen shows it outright:
| Where it is typed or shown | Can a key display see the keys? | What to do |
|---|---|---|
| A standard password field | No, secure input is on | Nothing extra |
| 1Password, Bitwarden, Keychain Access, Passwords | Typebar hides typing in them | Keep them on the list |
| A sudo or ssh password prompt | Not in Terminal; other terminal apps vary | Test yours; Secure Keyboard Entry or Pause |
| The wrong field, a chat or a note | Yes, it is ordinary typing | Pause, Hide letters, a demo password |
| A field with the password revealed | It does not matter, the screen shows it | Hide it again before recording |
The wrong field. This is the leak that catches people. Focus moves to the username box, the search bar or a chat window, you type the password without looking, and to every app on the Mac that is just text. The overlay shows it like any other word, and so does the field. For live demos, Hide letters is a good safety net: shortcuts and special keys still show, letters show as dots, so a slip in the wrong place shows as a row of dots. Hide what you type but keep shortcuts visible compares it with the other settings.
Password managers. Their windows are full of things you would rather not type on camera, and some of their fields are ordinary text fields. Typebar’s “Hide typing in these apps” list starts with 1Password, Bitwarden, Keychain Access and Apple’s Passwords app. While one of them is in front, nothing typed shows, though shortcuts and special keys still do, so viewers see you copy a password without seeing anything typed. Add any other app that holds secrets: an SSH client, a database tool, your bank’s app.
Terminal. When sudo or ssh asks for a password, it turns off echo, so nothing you type appears in the window. Apple’s Terminal notices that and turns on secure input by itself for the length of the prompt, so a key display sees nothing there. Other terminal apps, and the terminals built into code editors, may not do the same. Whatever you record in, test it once: at a password prompt, type a few letters that are not your password, and watch the overlay. If the keys show, turn on that app’s Secure Keyboard Entry just before the prompt, if it has one, or pause the overlay. Turn Secure Keyboard Entry off again afterwards, or the rest of your terminal session will not show either.
AutoFill. A password filled in by the Mac’s own AutoFill, or by a password manager’s browser extension, usually goes straight into the field rather than being typed, so a key display has nothing to show. It is the cleanest way to log in on camera.
Pause for the risky moment
When a login on camera cannot be avoided and you are not sure the field is a secure one, pause the overlay. Choose Pause from Typebar’s menu bar menu, or press the Pause shortcut if you have set one, and it stops showing what you type and click until you choose Resume.
Pause, log in, resume. In an edited recording you cut the gap. In a live demo or a screen share the overlay simply goes quiet for a few seconds, which viewers barely notice.
Use a demo account
The setting that never fails is the one you do not need. Record logins with a demo account whose password you would be happy to read aloud, and keep your real passwords off camera entirely.
For anything you record often, a separate macOS user account made in System Settings, under Users & Groups, helps more than any overlay setting. Its keychain, browser history and AutoFill suggestions hold only demo data, so there is nothing real to leak in the first place.
Check before you publish
Give every recording with a login one pass before it goes anywhere:
- Find every login. Sign-in pages, sheets asking for a password, Terminal prompts, a password manager asking for its main password. Step through each one frame by frame rather than at full speed.
- Watch the overlay. The pill should say typing is hidden, or show nothing, while the password goes in. If you show the full keyboard, no letter keys should light during that stretch.
- Watch the field and the window. Look for revealed passwords, AutoFill lists of usernames, and a password manager window opened to a real item.
- Watch everything else in frame. Notification banners, a second window, a browser address bar suggesting a private URL.
- If a password made it in, cut it and change the password anyway. If the video has already been shared or published, changing the password is the only fix that counts, because copies may exist.
This takes a few minutes and is the only check that covers every way a password can reach the screen, not just the overlay.
Typebar is $9 once for up to 5 Macs, and you can try it free for 24 hours with everything on.
Questions
Can a keystroke overlay see my passwords?
Not in a field where macOS turns on secure input; nothing typed there reaches it. Outside such fields a key display sees ordinary typing, which is why the hidden-apps list, Hide letters and Pause matter.
Does Typebar save or send what I type?
No. Nothing you type is saved or sent anywhere, and it needs only the Accessibility permission.
Should I add Terminal to the hidden apps?
Usually not. Terminal already turns on secure input at sudo and ssh password prompts, and with Terminal on the list the commands you type would never show, which defeats a terminal tutorial. Add it only if you never record terminal work.