diff --git a/packages/strapi-plugin-users-permissions/models/User.settings.json b/packages/strapi-plugin-users-permissions/models/User.settings.json
index e64b741cbb..f1aa1b2b13 100644
--- a/packages/strapi-plugin-users-permissions/models/User.settings.json
+++ b/packages/strapi-plugin-users-permissions/models/User.settings.json
@@ -25,7 +25,8 @@
     "password": {
       "type": "password",
       "minLength": 6,
-      "configurable": false
+      "configurable": false,
+      "private": true
     },
     "resetPasswordToken": {
       "type": "string",
diff --git a/packages/strapi/lib/core/configurations.js b/packages/strapi/lib/core/configurations.js
index 97e38a3411..4d6005b159 100755
--- a/packages/strapi/lib/core/configurations.js
+++ b/packages/strapi/lib/core/configurations.js
@@ -244,6 +244,9 @@ module.exports.app = async function() {
       boom: {
         enabled: true
       },
+      mask: {
+        enabled: true
+      },
       // Necessary middlewares for the administration panel.
       cors: {
         enabled: true