diff --git a/glance/db/__init__.py b/glance/db/__init__.py
index 1956059661..cbc5702b38 100644
--- a/glance/db/__init__.py
+++ b/glance/db/__init__.py
@@ -22,6 +22,7 @@ from glance.openstack.common import importutils
 
 sql_connection_opt = cfg.StrOpt('sql_connection',
                                 default='sqlite:///glance.sqlite',
+                                secret=True,
                                 metavar='CONNECTION',
                                 help='A valid SQLAlchemy connection '
                                      'string for the registry database. '
diff --git a/glance/registry/__init__.py b/glance/registry/__init__.py
index e9b7350c34..d236ca476c 100644
--- a/glance/registry/__init__.py
+++ b/glance/registry/__init__.py
@@ -37,12 +37,12 @@ registry_client_opts = [
     cfg.StrOpt('registry_client_key_file'),
     cfg.StrOpt('registry_client_cert_file'),
     cfg.StrOpt('registry_client_ca_file'),
-    cfg.StrOpt('metadata_encryption_key'),
+    cfg.StrOpt('metadata_encryption_key', secret=True),
     ]
 registry_client_ctx_opts = [
-    cfg.StrOpt('admin_user'),
-    cfg.StrOpt('admin_password'),
-    cfg.StrOpt('admin_tenant_name'),
+    cfg.StrOpt('admin_user', secret=True),
+    cfg.StrOpt('admin_password', secret=True),
+    cfg.StrOpt('admin_tenant_name', secret=True),
     cfg.StrOpt('auth_url'),
     cfg.StrOpt('auth_strategy', default='noauth'),
     cfg.StrOpt('auth_region'),