# When running CREATE USER command, does secret password appear in plain text (in logs, etc.)?

**URL:** <https://community.cratedb.com/t/when-running-create-user-command-does-secret-password-appear-in-plain-text-in-logs-etc/831>\
**Category:** Documentation\
**Created:** [September 30, 2021, 12:09pm UTC](https://community.cratedb.com/t/when-running-create-user-command-does-secret-password-appear-in-plain-text-in-logs-etc/831 "2021-09-30T12:09:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Emre\_Sevinc](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/emre_sevinc/32/375_2.png) [@Emre\_Sevinc](https://community.cratedb.com/u/Emre_Sevinc)\
**Post date:** [September 30, 2021, 12:09pm UTC](https://community.cratedb.com/t/when-running-create-user-command-does-secret-password-appear-in-plain-text-in-logs-etc/831/1 "2021-09-30T12:09:14Z")

</div>

Hello,

When running CREATE USER commnad, does secret password appear in plain text (in logs, etc.)? According to [Create user — CrateDB: Tutorials](https://crate.io/docs/crate/tutorials/en/latest/create-user.html#create-user) I can run the following SQL command in `crash`:

`cr> CREATE USER username WITH (password = 'a_secret_password');`

but then I wonder if the **password** will be **visible** in **plain text** in log files, history files, etc.

Is there a workaround for this?

For example, when I use PostgreSQL’s [psql command line client](https://www.postgresql.org/docs/current/app-psql.html), I can use `\password` command and “This makes sure that the new password does not appear in cleartext in the command history, the server log, or elsewhere.”

---

<div class="post-metadata">

**Author:** ![proddata](https://sea2.discourse-cdn.com/flex020/user_avatar/community.cratedb.com/proddata/32/1379_2.png) [@proddata](https://community.cratedb.com/u/proddata)\
**Post date:** [September 30, 2021, 2:17pm UTC](https://community.cratedb.com/t/when-running-create-user-command-does-secret-password-appear-in-plain-text-in-logs-etc/831/2 "2021-09-30T14:17:03Z")

</div>

By default this would not be logged to disk, as job logs are not persisted. However it would show up in `sys.jobs_log` table. Only the `crate` super user has access to all jobs logs. (i.e. you would need access to the cluster itself to see or change passwords).

One can set a `stats.jobs_log_filter` like

```sql
classification['type'] = 'DDL'

```

or

```sql
stmt LIKE 'CREATE USER%'

```

to prevent any logging

> **[Cluster-wide settings](https://crate.io/docs/crate/reference/en/4.6/config/cluster.html#stats-jobs-log-filter)**
>
> All current applied cluster settings can be read by querying the sys.cluster.settings column. Most cluster settings can be changed at runtime. This is documented at each setting. Table of contents Non-runtime cluster-wide settings, Collecting stats,...