diff --git a/pulsar-io/canal/src/main/java/org/apache/pulsar/io/canal/CanalSourceConfig.java b/pulsar-io/canal/src/main/java/org/apache/pulsar/io/canal/CanalSourceConfig.java
index 1af70c1280b2b..90cf08b1a601c 100644
--- a/pulsar-io/canal/src/main/java/org/apache/pulsar/io/canal/CanalSourceConfig.java
+++ b/pulsar-io/canal/src/main/java/org/apache/pulsar/io/canal/CanalSourceConfig.java
@@ -44,11 +44,13 @@ public class CanalSourceConfig implements Serializable{
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Username to connect to mysql database")
     private String username;
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Password to connect to mysql database")
     private String password;
     @FieldDoc(
diff --git a/pulsar-io/core/src/main/java/org/apache/pulsar/io/core/annotations/FieldDoc.java b/pulsar-io/core/src/main/java/org/apache/pulsar/io/core/annotations/FieldDoc.java
index 465da13d829a1..beda53d31fc71 100644
--- a/pulsar-io/core/src/main/java/org/apache/pulsar/io/core/annotations/FieldDoc.java
+++ b/pulsar-io/core/src/main/java/org/apache/pulsar/io/core/annotations/FieldDoc.java
@@ -44,6 +44,13 @@
      */
     String defaultValue();
 
+    /**
+     * Return if the field is a sensitive type or not.
+     * usernames/password/accesstokensm etc are some example of sensitive fields
+     * @return true if the field is sensitive, otherwise false
+     */
+    boolean sensitive() default false;
+
     /**
      * Return the description of this field.
      *
diff --git a/pulsar-io/elastic-search/src/main/java/org/apache/pulsar/io/elasticsearch/ElasticSearchConfig.java b/pulsar-io/elastic-search/src/main/java/org/apache/pulsar/io/elasticsearch/ElasticSearchConfig.java
index f929f9727e82b..1268f1994f8f8 100644
--- a/pulsar-io/elastic-search/src/main/java/org/apache/pulsar/io/elasticsearch/ElasticSearchConfig.java
+++ b/pulsar-io/elastic-search/src/main/java/org/apache/pulsar/io/elasticsearch/ElasticSearchConfig.java
@@ -77,6 +77,7 @@ public class ElasticSearchConfig implements Serializable {
     @FieldDoc(
         required = false,
         defaultValue = "",
+        sensitive = true,
         help = "The username used by the connector to connect to the elastic search cluster. If username is set, a password should also be provided."
     )
     private String username;
@@ -84,6 +85,7 @@ public class ElasticSearchConfig implements Serializable {
     @FieldDoc(
         required = false,
         defaultValue = "",
+        sensitive = true,
         help = "The password used by the connector to connect to the elastic search cluster. If password is set, a username should also be provided"
     )
     private String password;
diff --git a/pulsar-io/jdbc/src/main/java/org/apache/pulsar/io/jdbc/JdbcSinkConfig.java b/pulsar-io/jdbc/src/main/java/org/apache/pulsar/io/jdbc/JdbcSinkConfig.java
index b0508ba50f73a..3bfc72c1a4b59 100644
--- a/pulsar-io/jdbc/src/main/java/org/apache/pulsar/io/jdbc/JdbcSinkConfig.java
+++ b/pulsar-io/jdbc/src/main/java/org/apache/pulsar/io/jdbc/JdbcSinkConfig.java
@@ -43,12 +43,14 @@ public class JdbcSinkConfig implements Serializable {
     @FieldDoc(
         required = false,
         defaultValue = "",
+        sensitive = true,
         help = "Username used to connect to the database specified by `jdbcUrl`"
     )
     private String userName;
     @FieldDoc(
         required = false,
         defaultValue = "",
+        sensitive = true,
         help = "Password used to connect to the database specified by `jdbcUrl`"
     )
     private String password;
diff --git a/pulsar-io/redis/src/main/java/org/apache/pulsar/io/redis/RedisAbstractConfig.java b/pulsar-io/redis/src/main/java/org/apache/pulsar/io/redis/RedisAbstractConfig.java
index 519b39846a967..ab6c29366e666 100644
--- a/pulsar-io/redis/src/main/java/org/apache/pulsar/io/redis/RedisAbstractConfig.java
+++ b/pulsar-io/redis/src/main/java/org/apache/pulsar/io/redis/RedisAbstractConfig.java
@@ -55,6 +55,7 @@ public class RedisAbstractConfig implements Serializable {
     @FieldDoc(
         required = false,
         defaultValue = "",
+        sensitive = true,
         help = "The password used to connect to Redis")
     private String redisPassword;
 
diff --git a/pulsar-io/twitter/src/main/java/org/apache/pulsar/io/twitter/TwitterFireHoseConfig.java b/pulsar-io/twitter/src/main/java/org/apache/pulsar/io/twitter/TwitterFireHoseConfig.java
index 3d361afeecb5f..f2cf10cb047b8 100644
--- a/pulsar-io/twitter/src/main/java/org/apache/pulsar/io/twitter/TwitterFireHoseConfig.java
+++ b/pulsar-io/twitter/src/main/java/org/apache/pulsar/io/twitter/TwitterFireHoseConfig.java
@@ -59,6 +59,7 @@ public class TwitterFireHoseConfig implements Serializable {
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Your twitter app consumer key. See "
                 + "https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens for details"
     )
@@ -67,6 +68,7 @@ public class TwitterFireHoseConfig implements Serializable {
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Your twitter app consumer secret. "
                 + "See https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens for details"
     )
@@ -75,6 +77,7 @@ public class TwitterFireHoseConfig implements Serializable {
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Your twitter app token. "
                 + "See https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens for details"
     )
@@ -83,6 +86,7 @@ public class TwitterFireHoseConfig implements Serializable {
     @FieldDoc(
         required = true,
         defaultValue = "",
+        sensitive = true,
         help = "Your twitter app token secret. "
                 + "See https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens for details"
     )