title: Hiding passwords in Jenkins Pipeline log output without using WithCredentials
body: <p>I have a parametrized Jenkins pipeline based on a <code>Jenkinsfile</code>. Some of the parameters contain sensitive passwords that I don't want to appear in the job's build logs.</p>
  
  <p>So my question is: can I somehow register a String within the <code>Jenkinsfile</code> that is then replaced - by let's say <code>**********</code> - whenever it appears in the log output?</p>
  
  <p>I am aware of the <code>withCredentials</code> step, but I can't use it, since the credentials are not stored in the Jenkins credentials store (but provided as parameters at runtime).</p>
  
  <p>I found this answer here <a href="https://stackoverflow.com/a/42372859/1549950">https://stackoverflow.com/a/42372859/1549950</a> and tried it like this:</p>
  
  <pre><code>def secrets = [
      [password: firstPassword, var: 'SECRET'],
      [password: secondPassword, var: 'SECRET'],
      [password: thirdPassword, var: 'SECRET']
  ]
  
  node() {
      wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: secrets]) {
          // my stages containing steps...
      }
  }
  </code></pre>
  
  <p>Where <code>firstPassword</code>, <code>secondPassword</code>, <code>thirdPassword</code> are variables containing my passwords. But still I get the content of <code>firstPassword</code>... displayed plain text in the log output.</p>
  
  <p>I have the <a href="https://plugins.jenkins.io/mask-passwords" rel="noreferrer">Mask Password plugin</a> installed on my Jenkins in version 2.12.0.</p>
  
  <p>Basically I am searching for something like this: <a href="https://issues.jenkins-ci.org/browse/JENKINS-27486" rel="noreferrer">https://issues.jenkins-ci.org/browse/JENKINS-27486</a> - ticket is resolved, but no sample snippet of final implementation is given.</p>