diff --git a/oslo/config/cfg.py b/oslo/config/cfg.py
index 555b9109..0ff708ed 100644
--- a/oslo/config/cfg.py
+++ b/oslo/config/cfg.py
@@ -1972,7 +1972,7 @@ class ConfigOpts(collections.Mapping):
 
         def _sanitize(opt, value):
             """Obfuscate values of options declared secret."""
-            return value if not opt.secret else '*' * len(str(value))
+            return value if not opt.secret else '*' * 4
 
         for opt_name in sorted(self._opts):
             opt = self._get_opt_info(opt_name)['opt']
diff --git a/tests/test_cfg.py b/tests/test_cfg.py
index 9e983919..7b6d2822 100644
--- a/tests/test_cfg.py
+++ b/tests/test_cfg.py
@@ -2803,7 +2803,7 @@ class OptDumpingTestCase(BaseTestCase):
                          "foo                            = this",
                          "passwd                         = ****",
                          "blaa.bar                       = that",
-                         "blaa.key                       = *****",
+                         "blaa.key                       = ****",
                          "*" * 80,
                          ])