The userinfo a URL carries, exactly as written — ["alice:pa#ss"] for
https://alice:pa#ss@host — or [] when it carries none. Only a value that starts
with a scheme (^[A-Za-z][A-Za-z0-9+.-]*://) counts: a bare a:b@c is a file name
(-o run:2026-10-09@x.json), a search text or a User-Agent as often as a credential,
and the base URL always has a scheme. It works on URLs that don't parse too: the
userinfo is everything between :// and the last @ before the host. Used to redact
those exact strings from text that echoes the value (usage errors, help), whatever
characters the password contains.
The userinfo a URL carries, exactly as written —
["alice:pa#ss"]forhttps://alice:pa#ss@host— or[]when it carries none. Only a value that starts with a scheme (^[A-Za-z][A-Za-z0-9+.-]*://) counts: a barea:b@cis a file name (-o run:2026-10-09@x.json), a search text or a User-Agent as often as a credential, and the base URL always has a scheme. It works on URLs that don't parse too: the userinfo is everything between://and the last@before the host. Used to redact those exact strings from text that echoes the value (usage errors, help), whatever characters the password contains.