Plain

What a login form decodes to: the text as typed, alive only until it is hashed or verified.

A class whose toString redacts, for the reason Secret's is one: the failure this type exists to prevent is the plain text reaching a log, and a log line is written by interpolating whatever is in scope. An opaque type over String cannot defend against that, since toString is a member of Any and an extension method never wins against one, so the redaction would be a comment rather than a guarantee.

There is no way back to the text from outside this module, which is what makes storing one impossible rather than merely discouraged.