Credential generators

Credential generators deliberately avoid observed source values. Dump inference uses these kinds for high-confidence password, token, API-key, secret, private-key, and salt columns.

Note

These values are test fixtures, not production credentials. They are generated for shape and recognizability, not cryptographic security or password hashing.

Catalog

Kind	Arguments and defaults	Output
credential.token	length=32, alphabet=alphanumeric, prefix=""	Random credential-shaped text
credential.api_key	length=32, alphabet=alphanumeric, prefix="sk_"	API-key-shaped text
credential.secret	length=48, alphabet=alphanumeric, prefix=""	Longer random secret-shaped text
credential.password_hash	none	$synthetic$ plus 64 lowercase hex characters
credential.placeholder	none	SYNTHETIC_PLACEHOLDER_NOT_A_REAL_CREDENTIAL

The configurable alphabets are alphanumeric, hex, numeric, alpha, and url_safe. Length must be positive and the prefix is literal.

columns:
  api_key:
    generator:
      kind: credential.api_key
      prefix: test_sk_
      length: 40
  password_hash:
    generator: { kind: credential.password_hash }
  private_key:
    generator: { kind: credential.placeholder }

Inference guarantee and explicit overrides

Inference never chooses constant, weighted_choice, or observed_sample for a recognized credential column. It may preserve safe shape facts such as length, alphabet class, or prefix while discarding content.

An explicit model is authoritative: it can deliberately assign a literal-based generator to a credential-shaped column. That choice is allowed and is reported through GEN-SOURCE-VALUES; sql-splitter does not silently replace it.