diff --git a/src/server/config.rs b/src/server/config.rs
index d178364..2aa1690 100644
--- a/src/server/config.rs
+++ b/src/server/config.rs
@@ -7,6 +7,34 @@ use serde::Deserialize;
 /// (Secure cookies can't be set over HTTP. Rough assumption: development is done over HTTP)
 const DEFAULT_COOKIES_SECURE: bool = cfg!(not(debug_assertions));
 
+// Simple newtype to avoid showing secrets with `Debug` / `Display`
+#[derive(Clone, Deserialize)]
+pub struct SecretString(String);
+
+impl SecretString {
+    pub fn expose(&self) -> &String {
+        &self.0
+    }
+}
+
+impl From<String> for SecretString {
+    fn from(s: String) -> Self {
+        Self(s)
+    }
+}
+
+impl std::fmt::Debug for SecretString {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "*****")
+    }
+}
+
+impl std::fmt::Display for SecretString {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "*****")
+    }
+}
+
 #[derive(Debug, Clone, Deserialize)]
 pub struct AuthConfig {
     pub open_signup: bool,