diff --git a/lib/train/transports/ssh_connection.rb b/lib/train/transports/ssh_connection.rb
index c4a60a6b..5e07194c 100644
--- a/lib/train/transports/ssh_connection.rb
+++ b/lib/train/transports/ssh_connection.rb
@@ -216,7 +216,9 @@ def session(retry_options = {})
     #
     # @api private
     def to_s
-      "#{@username}@#{@hostname}<#{@options.inspect}>"
+      options_to_print = @options.clone
+      options_to_print[:password] = '<hidden>' if options_to_print.key?(:password)
+      "#{@username}@#{@hostname}<#{options_to_print.inspect}>"
     end
 
     class OS < OSCommon
diff --git a/test/unit/transports/ssh_test.rb b/test/unit/transports/ssh_test.rb
index 4792e1f5..fb60ac19 100644
--- a/test/unit/transports/ssh_test.rb
+++ b/test/unit/transports/ssh_test.rb
@@ -82,6 +82,15 @@ def detect_family
     end
   end
 
+  describe 'converting connection to string for logging' do
+   it "masks passwords" do
+      assert_output(/.*:password=>"<hidden>".*/) do
+        connection = cls.new(conf).connection
+        puts "#{connection}"
+      end
+    end
+  end
+
   describe 'failed configuration' do
     it 'works with a minimum valid config' do
       cls.new(conf).connection