Trjtdtk

One option would be to force yourself to use a function instead of echo, such as:

obfuprint() 
 if [ "$#1" -ge 8 ]
 then
 printf '%sn' "$1/????????/********"
 else
 printf '%sn' "$1//?/*"
 fi

Then you could call obfuprint 'secretvalue' and receive ********lue (with a trailing newline). The function uses parameter expansion to search for the first eight characters of the passed-in value and replaces them with eight asterisks. If the incoming value is shorter than eight characters, they are all replaced with asterisks. Thanks to ilkkachu for pointing out my initial assumption of eight-or-more character inputs!

Inspired by ilkkachu's flexible masking answer, I thought it'd be interesting to add a variation that randomly masks some percentage of the string:

obfuprintperc () 
 local perc=75 ## percent to obfuscate
 local i=0
 for((i=0; i < $#1; i++))
 do
 if [ $(( $RANDOM % 100 )) -lt "$perc" ]
 then
 printf '%s' '*'
 else
 printf '%s' "$1:i:1"
 fi
 done
 echo

This relies on bash's $RANDOM special variable; it simply loops through each character of the input and decides whether to mask that character or print it. Sample output:

$ obfuprintperc 0123456789
0*****6*8*
$ obfuprintperc 0123456789
012***678*
$ obfuprintperc 0123456789
**********
$ obfuprintperc 0123456789
*****56***
$ obfuprintperc 0123456789
0*******8*

You could try piping to sed. For example, to replace the first 8 characters of a string with asterisks, you could pipe to the sed 's/^......../********/' command, e.g.:

$ echo 'secretvalue' | sed 's/^......../********/'
********lue

You can also define a function that does this:

obsecho () echo "$1" 

A zsh variant that masks three quarters of the text:

mask() printf '%sn' $(l:$#1::*:)1:$#1*3/4

Example:

$ mask secretvalue
********lue
$ mask 12345678
******78
$ mask 1234
***4

To mask the first 8 chars:

mask() printf '%sn' $(l:$#1::*:)1:8

To mask all but the last 3 chars:

mask() printf '%sn' $(l:$#1::*:)1: -3

To mask a random number of characters:

mask() printf '%sn' $(l:$#1::*:)1: RANDOM%$#1

Another option in Bash, if you don’t mind one simple eval you can do it with a couple of printf:

# example data
password=secretvalue
chars_to_show=3

# the real thing
eval "printf '*%.0s' 1..$(($#password - chars_to_show))"
printf '%sn' $password: -chars_to_show

But be careful:

• fix the above as you need when $#password is less than $chars_to_show
  


• eval can be very dangerous with untrusted input: here it can be considered safe because its input comes only from safe sources, ie the length of $password and the value of $chars_to_show
  

Here's some toy Bash scripts to play with that show how to combine regex-like search with string substitution.

strip_str.sh

#!/usr/bin/env bash

_str="$1"
_filter="$2:-'apl'"
echo "$_str//[$_filter]/"

strip_str.sh 'apple-foo bar'
# -> e-foo br
strip_str.sh 'apple-foo bar' 'a'
# -> pple-foo br

privatize_str.sh

#!/usr/bin/env bash

_str="$1"
_filter="$2:-'apl'"
_replace="$3:-'*'"
echo "$_str//[$_filter]/$_replace"

privatize_str.sh 'apple-foo bar'
# -> ****e-foo b*r

restricted_str.sh

#!/usr/bin/env bash

_str="$1"
_valid="$2:-'a-z'"
_replace="$3:-''"
echo "$_str//[^$_valid]/$_replace"

restricted_str.sh 'apple-foo bar'
# -> applefoobar

Key takeaways

• 
  [a-z 0-9] is totally valid, and handy, as a <search> within $_var_name//<search>/<replace> for Bash


• 
  ^, within this context, is the reverse or not for regex-like searches


• Built-ins are generally faster and often are more concise, especially when it cuts out unneeded piping

While I get that printf is better in nearly all use cases the above code uses echo so as to not overly confuse what's going on.

obfuscate_str.sh

#!/usr/bin/env bash

_str="$1"
_start="$2:-6"
_header="$(for i in 1..$_start; do echo -n '*'; done)"
echo "$_header$_str:$_start"

obfuscate_str.sh 'apple-foo bar' 3
# -> ***le-foo bar