diff --git a/apps/emqx_conf/src/emqx_conf_cli.erl b/apps/emqx_conf/src/emqx_conf_cli.erl
index 109e88b4d..6cb53f8f3 100644
--- a/apps/emqx_conf/src/emqx_conf_cli.erl
+++ b/apps/emqx_conf/src/emqx_conf_cli.erl
@@ -108,7 +108,17 @@ admins(_) ->
     emqx_ctl:usage(usage_sync()).
 
 audit(Level, From, Log) ->
-    ?AUDIT(Level, From, Log#{time => logger:timestamp()}).
+    Log1 = redact(Log#{time => logger:timestamp()}),
+    ?AUDIT(Level, From, Log1).
+
+redact(Logs = #{cmd := admins, args := ["add", Username, _Password | Rest]}) ->
+    Logs#{args => ["add", Username, "******" | Rest]};
+redact(Logs = #{cmd := admins, args := ["passwd", Username, _Password]}) ->
+    Logs#{args => ["passwd", Username, "******"]};
+redact(Logs = #{cmd := license, args := ["update", _License]}) ->
+    Logs#{args => ["update", "******"]};
+redact(Logs) ->
+    Logs.
 
 usage_conf() ->
     [