Blur, black-bar or character-mask a sensitive string with hover / click / press-and-hold reveal — where mask actually removes the plaintext from the DOM.
npx shadcn@latest add @zyeon/redacted-textZyeon UI limits how often it can be asked, and Redacted Text hasn't had its turn. Its source will show here once it has.