The problem it solves
Run password-bearing commands through AI agents without secrets entering the conversation, logs, or history.
Secrets sit locally under AES-256-GCM + RSA-3072 envelope encryption; the master passphrase can live in the OS keychain for zero interaction.
Five-minute quick start
Four commands from init to handing over to the AI.
One-time AI setup: put the visibility contract into AGENTS.md, or install the bundled skill (skills/pwhide/install.sh).
Windows visual GUI (optional)
The win-x64 package contains PwHide.Gui.exe: unlock with the master passphrase to list, create and delete entries via a form (per-field encrypt-or-plain, weak-password warning, placeholder view). Shares the same encrypted vault as the CLI — always in sync. Boundary: entry management only; exec/rotate/harden/keychain stay in the CLI.
Stream forwarding (pipes)
stdin is forwarded to the child byte-for-byte; output is binary-safe (gzip -c f > out.gz works) and still redacted when rules are active. -f - reads the script from a pipe. With a piped stdin, the master passphrase must come from keychain/env/file (pwhide fails fast with guidance instead of eating your data). Note: placeholders are replaced in argv/scripts, not in piped data; never pipe secrets in.
Human verification channel
Confirm stored secrets are correct — unreachable by AI.
pwhide verify entry and exec --verify exist only on a real interactive terminal and force a typed passphrase; AI invocation is refused.
Windows encoding: why it kept breaking, and the fix
cmd's OEM code page (GBK) + PowerShell's [Console]::OutputEncoding + pipes switching decoders: the same bytes render differently per consumer. 0.7+ adapts by handle type; when in doubt, doctor --output-encoding forces it globally.
Byte-level verification report
Produced by the real binary and decoded exactly as each Windows consumer would; the script ships in the repo (scripts/encoding-visual-proof.py).
Markdown edition: guide.en.md