diff --git a/apps/emqx_coap/src/emqx_coap_mqtt_adapter.erl b/apps/emqx_coap/src/emqx_coap_mqtt_adapter.erl
index c10efd655..29a0e5d33 100644
--- a/apps/emqx_coap/src/emqx_coap_mqtt_adapter.erl
+++ b/apps/emqx_coap/src/emqx_coap_mqtt_adapter.erl
@@ -120,7 +120,7 @@ call(Pid, Msg, _) ->
 
 init({ClientId, Username, Password, Channel}) ->
     ?LOG(debug, "try to start adapter ClientId=~p, Username=~p, Password=~p, "
-                "Channel=~0p", [ClientId, Username, Password, Channel]),
+                "Channel=~0p", [ClientId, Username, "******", Channel]),
     State0 = #state{peername = Channel,
                     clientid = ClientId,
                     username = Username,
diff --git a/apps/emqx_coap/src/emqx_coap_resource.erl b/apps/emqx_coap/src/emqx_coap_resource.erl
index daa536540..2db10dc31 100644
--- a/apps/emqx_coap/src/emqx_coap_resource.erl
+++ b/apps/emqx_coap/src/emqx_coap_resource.erl
@@ -48,7 +48,7 @@ coap_discover(_Prefix, _Args) ->
     [{absolute, [<<"mqtt">>], []}].
 
 coap_get(ChId, ?MQTT_PREFIX, Path, Query, _Content) ->
-    ?LOG(debug, "coap_get() Path=~p, Query=~p~n", [Path, Query]),
+    ?LOG(debug, "coap_get() Path=~p, Query=~p~n", [Path, redact_query(Query)]),
     #coap_mqtt_auth{clientid = Clientid, username = Usr, password = Passwd} = get_auth(Query),
     case emqx_coap_mqtt_adapter:client_pid(Clientid, Usr, Passwd, ChId) of
         {ok, Pid} ->
@@ -65,7 +65,8 @@ coap_get(ChId, ?MQTT_PREFIX, Path, Query, _Content) ->
             {error, internal_server_error}
     end;
 coap_get(ChId, Prefix, Path, Query, _Content) ->
-    ?LOG(error, "ignore bad get request ChId=~p, Prefix=~p, Path=~p, Query=~p", [ChId, Prefix, Path, Query]),
+    ?LOG(error, "ignore bad get request ChId=~p, Prefix=~p, Path=~p, Query=~p",
+         [ChId, Prefix, Path, redact_query(Query)]),
     {error, bad_request}.
 
 coap_post(_ChId, _Prefix, _Topic, _Content) ->
@@ -149,3 +150,10 @@ topic([Path | TopicPath]) ->
             <<Path/binary, $/, RemTopic/binary>>
     end.
 
+redact_query(Auths) ->
+    lists:map(fun(<<$p, $=, _Rest/binary>>) ->
+                      <<$p, $=, "******">>;
+                 (E) ->
+                      E
+              end,
+              Auths).
diff --git a/apps/emqx_exproto/src/emqx_exproto_gsvr.erl b/apps/emqx_exproto/src/emqx_exproto_gsvr.erl
index 91d119c9a..7c6d9d62b 100644
--- a/apps/emqx_exproto/src/emqx_exproto_gsvr.erl
+++ b/apps/emqx_exproto/src/emqx_exproto_gsvr.erl
@@ -60,7 +60,7 @@ close(Req = #{conn := Conn}, Md) ->
 authenticate(Req = #{conn := Conn,
                      password := Password,
                      clientinfo := ClientInfo}, Md) ->
-    ?LOG(debug, "Recv ~p function with request ~0p", [?FUNCTION_NAME, Req]),
+    ?LOG_SENSITIVE(debug, "Recv ~p function with request ~0p", [?FUNCTION_NAME, Req]),
     case validate(clientinfo, ClientInfo) of
         false ->
             {ok, response({error, ?RESP_REQUIRED_PARAMS_MISSED}), Md};