Check Existing Issues

• I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Verify Feature Scope

• I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.

Problem Description

When creating Tools or Functions with UserValves that contain sensitive fields like passwords, the password is displayed as plain text in the OpenWebUI settings UI.

This is a security concern because:

• Passwords are visible on screen (shoulder surfing risk)
• Passwords may be visible in screenshots
• Users expect password fields to be masked in settings forms

Current Behavior:
The standard JSON Schema format: "password" attribute is not recognized by the Valves.svelte component.

class UserValves(BaseModel):
    exchange_password: str = Field(
        default="",
        description="Your Exchange/AD password",
        json_schema_extra={"format": "password"}  # <-- Currently IGNORED by the UI
    )

Desired Solution you'd like

Support the standard JSON Schema format: "password" attribute in Valves.svelte to render sensitive fields as password inputs (masked with dots).

OpenWebUI already has a SensitiveInput.svelte component. I propose modifying src/lib/components/common/Valves.svelte to use this existing component when the format is detected.

Implementation Logic:
Inside the valves rendering loop:

1. Check if valvesSpec.properties[property]?.format === 'password'
2. If true, render <SensitiveInput ... /> instead of the default <input type="text"> or <textarea>.

Alternatives Considered

• Using "api_key" naming convention: We considered naming fields api_key to hope for auto-detection, but this is semantically incorrect for actual user passwords (e.g., database or service passwords).
• Custom HTML in Description: Not supported/sanitized.
• Doing nothing: Leaves credentials exposed in the UI.

Additional Context

Implementation Suggestion:
In src/lib/components/common/Valves.svelte, add this condition to the main rendering loop:

{:else if valvesSpec.properties[property]?.format === 'password'}
    <SensitiveInput
        placeholder={valvesSpec.properties[property]?.description ?? ''}
        bind:value={valves[property]}
    />

Benefits:

• ✅ Security: Passwords hidden from view by default.
• ✅ Standard: Uses standard Pydantic/JSON Schema format: "password".
• ✅ Easy: Low-effort change leveraging the existing content.

For Tool Developers:
They can simply add json_schema_extra={"format": "password"} to their Pydantic models.