diff --git a/openstackclient/common/client_config.py b/openstackclient/common/client_config.py
index 30286df8af..d6297753b4 100644
--- a/openstackclient/common/client_config.py
+++ b/openstackclient/common/client_config.py
@@ -17,6 +17,8 @@ import logging
 
 from os_client_config import config
 from os_client_config import exceptions as occ_exceptions
+from oslo_utils import strutils
+import six
 
 
 LOG = logging.getLogger(__name__)
@@ -180,7 +182,9 @@ class OSC_Config(config.OpenStackConfig):
         config = self._auth_v2_ignore_v3(config)
         config = self._auth_default_domain(config)
 
-        LOG.debug("auth_config_hook(): %s" % config)
+        if LOG.isEnabledFor(logging.DEBUG):
+            LOG.debug("auth_config_hook(): %s",
+                      strutils.mask_password(six.text_type(config)))
         return config
 
     def load_auth_plugin(self, config):