Terraform 1.11 introduced write-only parameters for handling sensitive data like API tokens and passwords. These values are sent to the provider's API during create and update operations but are never stored in the Terraform state file, preventing sensitive information from being stored in plaintext.

The primary challenge is tracking changes. Since the secret value isn't in state, Terraform cannot detect when it's updated. The standard solution is a manual _version field that users must increment, which is not user-friendly.

A better approach uses private state to store a SHA-256 hash of the write-only inputs. This allows automatic change detection. However, some users may object to any hash of their secrets being stored, even in private state.

The recommended design supports both modes: auto-managed (hash-based) and manual (version-based). Preventing mode switching after creation simplifies the logic and provides clear error messages, offering a secure and flexible user experience.