diff --git a/cmd/dbaas_user_show.go b/cmd/dbaas_user_show.go
index 65f1c34d..58fcd5fe 100644
--- a/cmd/dbaas_user_show.go
+++ b/cmd/dbaas_user_show.go
@@ -12,6 +12,7 @@ import (
 type dbaasUserShowOutput struct {
 	Username string `json:"username,omitempty"`
 	Type     string `json:"type,omitempty"`
+	Password string `json:"password,omitempty"`
 
 	// Additional user info for some DBAAS Services
 	MySQL *dbaasMysqlUserShowOutput `json:"mysql,omitempty"`
@@ -30,6 +31,7 @@ func (o *dbaasUserShowOutput) ToTable() {
 
 	t.Append([]string{"Username", o.Username})
 	t.Append([]string{"Type", o.Type})
+	t.Append([]string{"Password", o.Password})
 
 	switch {
 	case o.MySQL != nil:
@@ -47,9 +49,10 @@ type dbaasUserShowCmd struct {
 
 	_ bool `cli-cmd:"show"`
 
-	Name     string `cli-arg:"#"`
-	Username string `cli-arg:"#"`
-	Zone     string `cli-short:"z" cli-usage:"Database Service zone"`
+	Name        string `cli-arg:"#"`
+	Username    string `cli-arg:"#"`
+	Zone        string `cli-short:"z" cli-usage:"Database Service zone"`
+	ShowSecrets bool   `cli-flag:"secrets" cli-usage:"reveal user password and other secrets"`
 }
 
 func (c *dbaasUserShowCmd) cmdAliases() []string { return nil }
diff --git a/cmd/dbaas_user_show_grafana.go b/cmd/dbaas_user_show_grafana.go
index f2a2bf42..9d81b648 100644
--- a/cmd/dbaas_user_show_grafana.go
+++ b/cmd/dbaas_user_show_grafana.go
@@ -27,7 +27,15 @@ func (c *dbaasUserShowCmd) showGrafana(ctx context.Context) (output.Outputter, e
 		if u.Username == c.Username {
 			return &dbaasUserShowOutput{
 				Username: c.Username,
-				Type:     u.Type,
+				Password: func() string {
+					if c.ShowSecrets {
+						return u.Password
+					} else {
+						return "xxxxxx"
+					}
+				}(),
+
+				Type: u.Type,
 			}, nil
 		}
 
diff --git a/cmd/dbaas_user_show_kafka.go b/cmd/dbaas_user_show_kafka.go
index 62e44e22..069a3b76 100644
--- a/cmd/dbaas_user_show_kafka.go
+++ b/cmd/dbaas_user_show_kafka.go
@@ -40,9 +40,22 @@ func (c *dbaasUserShowCmd) showKafka(ctx context.Context) (output.Outputter, err
 		if u.Username == c.Username {
 			return &dbaasUserShowOutput{
 				Username: c.Username,
-				Type:     u.Type,
+				Password: func() string {
+					if c.ShowSecrets {
+						return u.Password
+					} else {
+						return "xxxxxx"
+					}
+				}(),
+				Type: u.Type,
 				Kafka: &dbaasKafkaUserShowOutput{
-					AccessKey:        u.AccessKey,
+					AccessKey: func() string {
+						if c.ShowSecrets {
+							return u.AccessKey
+						} else {
+							return "xxxxxx"
+						}
+					}(),
 					AccessCert:       u.AccessCert,
 					AccessCertExpiry: u.AccessCertExpiry,
 				},
diff --git a/cmd/dbaas_user_show_mysql.go b/cmd/dbaas_user_show_mysql.go
index 195e3608..6450c8b0 100644
--- a/cmd/dbaas_user_show_mysql.go
+++ b/cmd/dbaas_user_show_mysql.go
@@ -36,7 +36,15 @@ func (c *dbaasUserShowCmd) showMysql(ctx context.Context) (output.Outputter, err
 		if u.Username == c.Username {
 			return &dbaasUserShowOutput{
 				Username: c.Username,
-				Type:     u.Type,
+				Password: func() string {
+					if c.ShowSecrets {
+						return u.Password
+					} else {
+						return "xxxxxx"
+					}
+				}(),
+
+				Type: u.Type,
 				MySQL: &dbaasMysqlUserShowOutput{
 					Authentication: u.Authentication,
 				},
diff --git a/cmd/dbaas_user_show_opensearch.go b/cmd/dbaas_user_show_opensearch.go
index 6b5dc188..891e71c0 100644
--- a/cmd/dbaas_user_show_opensearch.go
+++ b/cmd/dbaas_user_show_opensearch.go
@@ -27,7 +27,15 @@ func (c *dbaasUserShowCmd) showOpensearch(ctx context.Context) (output.Outputter
 		if u.Username == c.Username {
 			return &dbaasUserShowOutput{
 				Username: c.Username,
-				Type:     u.Type,
+				Password: func() string {
+					if c.ShowSecrets {
+						return u.Password
+					} else {
+						return "xxxxxx"
+					}
+				}(),
+
+				Type: u.Type,
 			}, nil
 		}
 
diff --git a/cmd/dbaas_user_show_pq.go b/cmd/dbaas_user_show_pq.go
index 2a631472..42131da6 100644
--- a/cmd/dbaas_user_show_pq.go
+++ b/cmd/dbaas_user_show_pq.go
@@ -39,7 +39,15 @@ func (c *dbaasUserShowCmd) showPG(ctx context.Context) (output.Outputter, error)
 		if u.Username == c.Username {
 			return &dbaasUserShowOutput{
 				Username: c.Username,
-				Type:     u.Type,
+				Password: func() string {
+					if c.ShowSecrets {
+						return u.Password
+					} else {
+						return "xxxxxx"
+					}
+				}(),
+
+				Type: u.Type,
 				PG: &dbaasPGUserShowOutput{
 					AllowReplication: u.AllowReplication,
 				},