I've posted RFC: SecureString - Obfuscated / masked strings exept when you need them in response to this post. Hopefully either this post, or that post will yield some responses that are useful to you. Unfortunately, the module I threw togeter for that post is too immature (and totally untested) for me to reccommend at this time. In fact, I would even reccommend against using the module as posted - relying on something so immature is a bad idea in my book.