mask credentials