The userinfo a URL carries, exactly as written — ["alice:pa#ss"] for
https://alice:pa#ss@host — or [] when it carries none. Only a value that starts
with a scheme (^[A-Za-z][A-Za-z0-9+.-]*://) counts: a bare a:b@c is a file name
(-o run:2026-10-09@x.json), a search text or a User-Agent as often as a credential,
and every URL oparl takes has a scheme (parseHttpUrl requires http:/https:). It
works on URLs that don't parse too: the userinfo is everything between :// and the
last @ before the host. Used to redact those exact strings from text that echoes the
value (usage errors, help), whatever characters the password contains — a pattern
can't delimit one holding a space, /, #, ? or @.
The userinfo a URL carries, exactly as written —
["alice:pa#ss"]forhttps://alice:pa#ss@host— or[]when it carries none. Only a value that starts with a scheme (^[A-Za-z][A-Za-z0-9+.-]*://) counts: a barea:b@cis a file name (-o run:2026-10-09@x.json), a search text or a User-Agent as often as a credential, and every URL oparl takes has a scheme (parseHttpUrlrequireshttp:/https:). It works on URLs that don't parse too: the userinfo is everything between://and the last@before the host. Used to redact those exact strings from text that echoes the value (usage errors, help), whatever characters the password contains — a pattern can't delimit one holding a space,/,#,?or@.