diff --git a/stores/settingsdb.go b/stores/settingsdb.go
index 3b1eafc31..f7ba1e82d 100644
--- a/stores/settingsdb.go
+++ b/stores/settingsdb.go
@@ -14,8 +14,8 @@ type (
 	dbSetting struct {
 		Model
 
-		Key   string `gorm:"unique;index;NOT NULL"`
-		Value string `gorm:"NOT NULL"`
+		Key   string  `gorm:"unique;index;NOT NULL"`
+		Value setting `gorm:"NOT NULL"`
 	}
 )
 
@@ -52,8 +52,8 @@ func (s *SQLStore) Setting(ctx context.Context, key string) (string, error) {
 	} else if err != nil {
 		return "", err
 	}
-	s.settings[key] = entry.Value
-	return entry.Value, nil
+	s.settings[key] = string(entry.Value)
+	return string(entry.Value), nil
 }
 
 // Settings implements the bus.SettingStore interface.
@@ -74,7 +74,7 @@ func (s *SQLStore) UpdateSetting(ctx context.Context, key, value string) error {
 		DoUpdates: clause.AssignmentColumns([]string{"value"}),
 	}).Create(&dbSetting{
 		Key:   key,
-		Value: value,
+		Value: setting(value),
 	}).Error
 	if err != nil {
 		return err
diff --git a/stores/types.go b/stores/types.go
index 42a8d29e4..a2628d834 100644
--- a/stores/types.go
+++ b/stores/types.go
@@ -35,8 +35,41 @@ type (
 	balance        big.Int
 	unsigned64     uint64 // used for storing large uint64 values in sqlite
 	secretKey      []byte
+	setting        string
 )
 
+// GormDataType implements gorm.GormDataTypeInterface.
+func (setting) GormDataType() string {
+	return "string"
+}
+
+// String implements fmt.Stringer to prevent "s3authentication" settings from
+// getting leaked.
+func (s setting) String() string {
+	if strings.Contains(string(s), "v4Keypairs") {
+		return "*****"
+	}
+	return string(s)
+}
+
+// Scan scans value into the setting
+func (s *setting) Scan(value interface{}) error {
+	switch value := value.(type) {
+	case string:
+		*s = setting(value)
+	case []byte:
+		*s = setting(value)
+	default:
+		return fmt.Errorf("failed to unmarshal setting value from type %t", value)
+	}
+	return nil
+}
+
+// Value returns a setting value, implements driver.Valuer interface.
+func (s setting) Value() (driver.Value, error) {
+	return string(s), nil
+}
+
 // GormDataType implements gorm.GormDataTypeInterface.
 func (secretKey) GormDataType() string {
 	return "bytes"
diff --git a/stores/types_test.go b/stores/types_test.go
new file mode 100644
index 000000000..c985dd012
--- /dev/null
+++ b/stores/types_test.go
@@ -0,0 +1,14 @@
+package stores
+
+import "testing"
+
+func TestTypeSetting(t *testing.T) {
+	s1 := setting("some setting")
+	s2 := setting("v4Keypairs")
+
+	if s1.String() != "some setting" {
+		t.Fatal("unexpected string")
+	} else if s2.String() != "*****" {
+		t.Fatal("unexpected string")
+	}
+}