---
id: "uri_with_password"
kind: "datatype"
status: "draft"
is_pii: true
categories: ["secrets", "internet"]
langs: ["common"]
quality: 78
url: "http://registry.apicrafter.io/datatype/uri_with_password"
---

# URI with embedded password (`uri_with_password`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and message broker connection URIs still use it. The user name may be empty, as in Redis URIs.

- Parent datatype: `uri`
- Personal data (PII): yes
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets), Internet (internet)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[A-Za-z][A-Za-z0-9+.-]*://[^\s:/?#@]*:[^\s/?#@]+@[^\s/?#]+(?:[/?#]\S*)?$
```

## Examples

- `postgresql://user:secret@localhost` — Example connection URI from the PostgreSQL documentation
- `postgresql://user@localhost` (invalid example) — User name without a password

## Supported by tools

- `detectsecrets`
- `semgrep`
- `trufflehog`

## Sources

- doc: <https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1>
- doc: <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING-URIS>

## Quality

Score 78/100. Missing: second example, mapping (Wikidata, Schema.org, ...), translation.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/uri_with_password.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/uri_with_password.yaml>