diff --git a/netbox/core/data_backends.py b/netbox/core/data_backends.py
index 6cc534774..43e6f4e79 100644
--- a/netbox/core/data_backends.py
+++ b/netbox/core/data_backends.py
@@ -41,6 +41,7 @@ def register_backend(name):
 
 class DataBackend:
     parameters = {}
+    sensitive_parameters = []
 
     def __init__(self, url, **kwargs):
         self.url = url
@@ -86,6 +87,7 @@ class GitBackend(DataBackend):
             widget=forms.TextInput(attrs={'class': 'form-control'})
         )
     }
+    sensitive_parameters = ['password']
 
     @contextmanager
     def fetch(self):
@@ -135,6 +137,7 @@ class S3Backend(DataBackend):
             widget=forms.TextInput(attrs={'class': 'form-control'})
         ),
     }
+    sensitive_parameters = ['aws_secret_access_key']
 
     REGION_REGEX = r's3\.([a-z0-9-]+)\.amazonaws\.com'
 
diff --git a/netbox/templates/core/datasource.html b/netbox/templates/core/datasource.html
index c69569358..992edb2d1 100644
--- a/netbox/templates/core/datasource.html
+++ b/netbox/templates/core/datasource.html
@@ -88,7 +88,11 @@
             {% for name, field in object.get_backend.parameters.items %}
               <tr>
                 <th scope="row">{{ field.label }}</th>
-                <td>{{ object.parameters|get_key:name|placeholder }}</td>
+                {% if name in object.get_backend.sensitive_parameters and not perms.core.change_datasource %}
+                  <td>********</td>
+                {% else %}
+                  <td>{{ object.parameters|get_key:name|placeholder }}</td>
+                {% endif %}
               </tr>
             {% empty %}
               <tr>