hide real credentials