diff --git a/src/htsback.c b/src/htsback.c
index 0c2c139e2..63e7bd886 100644
--- a/src/htsback.c
+++ b/src/htsback.c
@@ -172,7 +172,7 @@ hts_boolean back_spool_write(httrackp *opt, const char *filename,
         opt, LOG_WARNING | LOG_ERRNO,
         "engine: warning: serialize error for %s%s to %s: open "
         "error (%s, %s)",
-        back->url_adr, back->url_fil, filename,
+        adr_nologin(opt, back->url_adr), back->url_fil, filename,
         dir_exists(filename) ? "directory exists" : "directory does NOT exist!",
         fexist_utf8(filename) ? "file already exists!" : "file does not exist");
     back_tmpdir_drop(filename); /* filecreate() may have made the directory */
@@ -185,7 +185,7 @@ hts_boolean back_spool_write(httrackp *opt, const char *filename,
     hts_log_print(opt, LOG_WARNING | LOG_ERRNO,
                   "engine: warning: serialize error for %s%s to %s: write "
                   "error",
-                  back->url_adr, back->url_fil, filename);
+                  adr_nologin(opt, back->url_adr), back->url_fil, filename);
     (void) UNLINK(filename);
     back_tmpdir_drop(filename);
   }
@@ -341,7 +341,7 @@ static int back_connect_next(httrackp *opt, struct_back *sback, int i) {
   back[i].status = STATUS_CONNECTING;
   hts_log_print(opt, LOG_DEBUG,
                 "connect failed, trying next address (%d/%d) for %s", next + 1,
-                cf->addr_count, back[i].url_adr);
+                cf->addr_count, adr_nologin(opt, back[i].url_adr));
   return 1;
 }
 
@@ -468,14 +468,15 @@ static int back_index_ready(httrackp * opt, struct_back * sback, const char *adr
             itemback = NULL;
           }
           hts_log_print(opt, LOG_WARNING | LOG_ERRNO,
-                        "engine: warning: unserialize error for %s%s (%s)", adr,
-                        fil, sav);
+                        "engine: warning: unserialize error for %s%s (%s)",
+                        adr_nologin(opt, adr), fil, sav);
         }
         fclose(fp);
       } else {
         hts_log_print(opt, LOG_WARNING | LOG_ERRNO,
-                      "engine: warning: unserialize error for %s%s (%s), file disappeared",
-                      adr, fil, sav);
+                      "engine: warning: unserialize error for %s%s (%s), file "
+                      "disappeared",
+                      adr_nologin(opt, adr), fil, sav);
       }
       (void) UNLINK(fileback);
       back_tmpdir_drop(fileback);
@@ -498,8 +499,9 @@ static int back_index_ready(httrackp * opt, struct_back * sback, const char *adr
           return q;
         } else {
           hts_log_print(opt, LOG_WARNING,
-                        "engine: warning: unserialize error for %s%s (%s): no more space to wakeup frozen slots",
-                        adr, fil, sav);
+                        "engine: warning: unserialize error for %s%s (%s): no "
+                        "more space to wakeup frozen slots",
+                        adr_nologin(opt, adr), fil, sav);
         }
       }
     }
@@ -764,10 +766,12 @@ int back_cleanup_background(httrackp * opt, cache_back * cache,
                          back[i].url_sav, 1);
       if (checkIndex != -1) {
         hts_log_print(opt, LOG_WARNING,
-                      "engine: unexpected duplicate file entry: %s%s -> %s (%d '%s') / %s%s -> %s (%d '%s')",
-                      back[checkIndex].url_adr, back[checkIndex].url_fil,
-                      back[checkIndex].url_sav, back[checkIndex].r.statuscode,
-                      back[checkIndex].r.msg, back[i].url_adr, back[i].url_fil,
+                      "engine: unexpected duplicate file entry: %s%s -> %s (%d "
+                      "'%s') / %s%s -> %s (%d '%s')",
+                      adr_nologin(opt, back[checkIndex].url_adr),
+                      back[checkIndex].url_fil, back[checkIndex].url_sav,
+                      back[checkIndex].r.statuscode, back[checkIndex].r.msg,
+                      adr_nologin(opt, back[i].url_adr), back[i].url_fil,
                       back[i].url_sav, back[i].r.statuscode, back[i].r.msg);
         back_delete(NULL, NULL, sback, checkIndex);
 #ifdef _DEBUG
@@ -807,7 +811,7 @@ int back_cleanup_background(httrackp * opt, cache_back * cache,
         } else {
           hts_log_print(opt, LOG_WARNING | LOG_ERRNO,
                         "engine: warning: serialize error for %s%s: %s",
-                        back[i].url_adr, back[i].url_fil,
+                        adr_nologin(opt, back[i].url_adr), back[i].url_fil,
                         named ? "memory full" : "temporary filename too long");
         }
       }
@@ -1162,20 +1166,22 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
             "truncated chunked transfer (terminating chunk missing, got " LLintP
             " bytes): file not cached, will be retried on the next"
             " update (use -%%B to cache anyway): %s%s",
-            back[p].r.size, back[p].url_adr, back[p].url_fil);
+            back[p].r.size, adr_nologin(opt, back[p].url_adr), back[p].url_fil);
       } else if (back_status(&back[p]) == STATUS_READY) {
         hts_log_print(opt, LOG_WARNING,
                       "incomplete transfer (expected " LLintP
                       " bytes, got " LLintP
                       "): file not cached, will be retried on the next update"
                       " (use -%%B to cache anyway): %s%s",
-                      back[p].r.totalsize, back[p].r.size, back[p].url_adr,
-                      back[p].url_fil);
+                      back[p].r.totalsize, back[p].r.size,
+                      adr_nologin(opt, back[p].url_adr), back[p].url_fil);
       } else {
-        hts_log_print(opt, LOG_INFO,
-                      "incomplete file not yet stored in cache (expected "
-                      LLintP " got " LLintP "): %s%s", back[p].r.totalsize,
-                      back[p].r.size, back[p].url_adr, back[p].url_fil);
+        hts_log_print(
+            opt, LOG_INFO,
+            "incomplete file not yet stored in cache (expected " LLintP
+            " got " LLintP "): %s%s",
+            back[p].r.totalsize, back[p].r.size,
+            adr_nologin(opt, back[p].url_adr), back[p].url_fil);
       }
       back_finalize_backup(opt, &back[p], HTS_FALSE);
       /* Keep the surviving copy in new.lst, else the update purge drops the
@@ -1468,20 +1474,22 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
               HTS_STAT.stat_bytes += back[p].r.size;
               HTS_STAT.stat_files++;
               hts_log_print(opt, LOG_TRACE, "added file %s%s => %s",
-                            back[p].url_adr, back[p].url_fil, back[p].url_sav);
+                            adr_nologin(opt, back[p].url_adr), back[p].url_fil,
+                            back[p].url_sav);
             }
             if ((!back[p].r.notmodified) && (opt->is_update)) {
               HTS_STAT.stat_updated_files++;    // page modifiée
               if (back[p].is_update) {
-                hts_log_print(opt, LOG_INFO,
-                              "engine: transfer-status: link updated: %s%s -> %s",
-                              back[p].url_adr, back[p].url_fil,
-                              back[p].url_sav);
+                hts_log_print(
+                    opt, LOG_INFO,
+                    "engine: transfer-status: link updated: %s%s -> %s",
+                    adr_nologin(opt, back[p].url_adr), back[p].url_fil,
+                    back[p].url_sav);
               } else {
                 hts_log_print(opt, LOG_INFO,
                               "engine: transfer-status: link added: %s%s -> %s",
-                              back[p].url_adr, back[p].url_fil,
-                              back[p].url_sav);
+                              adr_nologin(opt, back[p].url_adr),
+                              back[p].url_fil, back[p].url_sav);
               }
               if (cache->txt) {
                 if (back[p].is_update) {
@@ -1491,9 +1499,11 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
                 }
               }
             } else {
-              hts_log_print(opt, LOG_INFO,
-                            "engine: transfer-status: link recorded: %s%s -> %s",
-                            back[p].url_adr, back[p].url_fil, back[p].url_sav);
+              hts_log_print(
+                  opt, LOG_INFO,
+                  "engine: transfer-status: link recorded: %s%s -> %s",
+                  adr_nologin(opt, back[p].url_adr), back[p].url_fil,
+                  back[p].url_sav);
               if (cache->txt) {
                 if (opt->is_update)
                   state = "untouched";
@@ -1502,10 +1512,11 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
               }
             }
           } else {
-            hts_log_print(opt, LOG_INFO,
-                          "engine: transfer-status: empty file? (%d, '%s'): %s%s",
-                          back[p].r.statuscode, back[p].r.msg, back[p].url_adr,
-                          back[p].url_fil);
+            hts_log_print(
+                opt, LOG_INFO,
+                "engine: transfer-status: empty file? (%d, '%s'): %s%s",
+                back[p].r.statuscode, back[p].r.msg,
+                adr_nologin(opt, back[p].url_adr), back[p].url_fil);
             if (cache->txt) {
               state = "empty";
             }
@@ -1513,8 +1524,8 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
         } else {
           hts_log_print(opt, LOG_INFO,
                         "engine: transfer-status: link error (%d, '%s'): %s%s",
-                        back[p].r.statuscode, back[p].r.msg, back[p].url_adr,
-                        back[p].url_fil);
+                        back[p].r.statuscode, back[p].r.msg,
+                        adr_nologin(opt, back[p].url_adr), back[p].url_fil);
           if (cache->txt) {
             state = "error";
           }
@@ -1552,8 +1563,8 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
         } else {
           /* error */
           if (!HTTP_IS_OK(back[p].r.statuscode)) {
-            hts_log_print(opt, LOG_DEBUG, "redirect to %s%s", back[p].url_adr,
-                          back[p].url_fil);
+            hts_log_print(opt, LOG_DEBUG, "redirect to %s%s",
+                          adr_nologin(opt, back[p].url_adr), back[p].url_fil);
             /* Store only header reference */
             cache_mayadd(opt, cache, &back[p].r, back[p].url_adr,
                          back[p].url_fil, NULL);
@@ -1564,7 +1575,7 @@ int back_finalize(httrackp * opt, cache_back * cache, struct_back * sback,
                 "file with unresolved type not cached (%s (%d), size " LLintP
                 "): %s%s",
                 back[p].r.msg, back[p].r.statuscode, (LLint) back[p].r.size,
-                back[p].url_adr, back[p].url_fil);
+                adr_nologin(opt, back[p].url_adr), back[p].url_fil);
           }
         }
 
@@ -2116,7 +2127,8 @@ int back_unserialize_ref(httrackp * opt, const char *adr, const char *fil,
   errno = 0;
   if (!ref_get_record(fp, back)) {
     hts_log_print(opt, LOG_DEBUG,
-                  "Ignoring an unreadable resume reference for %s%s", adr, fil);
+                  "Ignoring an unreadable resume reference for %s%s",
+                  adr_nologin(opt, adr), fil);
     fclose(fp);
     back_clear_entry(back);
     freet(back);
@@ -2161,7 +2173,7 @@ int back_maydelete(httrackp * opt, cache_back * cache, struct_back * sback,
         assertf(back[p].ka_time_start != 0);
         hts_log_print(opt, LOG_DEBUG,
                       "(Keep-Alive): successfully saved #%d (%s)",
-                      back[p].r.debugid, back[p].url_adr);
+                      back[p].r.debugid, adr_nologin(opt, back[p].url_adr));
         return 1;
       }
     }
@@ -2215,7 +2227,7 @@ void back_maydeletehttp(httrackp * opt, cache_back * cache, struct_back * sback,
       assertf(back[q].ka_time_start != 0);
       hts_log_print(opt, LOG_DEBUG,
                     "(Keep-Alive): successfully preserved #%d (%s)",
-                    back[q].r.debugid, back[q].url_adr);
+                    back[q].r.debugid, adr_nologin(opt, back[q].url_adr));
     } else {
       deletehttp(&back[p].r);
       back[p].r.soc = INVALID_SOCKET;
@@ -2482,7 +2494,8 @@ int back_delete(httrackp * opt, cache_back * cache, struct_back * sback,
       ) {
         hts_log_print(opt, LOG_DEBUG,
                       "File '%s%s' -> %s not yet saved in cache - saving now",
-                      back[p].url_adr, back[p].url_fil, back[p].url_sav);
+                      adr_nologin(opt, back[p].url_adr), back[p].url_fil,
+                      back[p].url_sav);
       }
       if (cache != NULL) {
         back_finalize(opt, cache, sback, p);
@@ -2583,8 +2596,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
   if (!test && back_exist(sback, opt, adr, fil, save)) {
     int already_there = 0;
 
-    hts_log_print(opt, LOG_ERROR, "error: back_add(%s,%s,%s) duplicate", adr,
-                  fil, save);
+    hts_log_print(opt, LOG_ERROR, "error: back_add(%s,%s,%s) duplicate",
+                  adr_nologin(opt, adr), fil, save);
   }
 #endif
 
@@ -2662,7 +2675,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
       back[p].status = STATUS_READY;    // terminé
       back_set_finished(opt, sback, p);
       hts_log_print(opt, LOG_WARNING,
-                    "File not added due to mirror cancel: %s%s", adr, fil);
+                    "File not added due to mirror cancel: %s%s",
+                    adr_nologin(opt, adr), fil);
       return 0;
     }
     // test "fast header" cache ; that is, tests we did that lead to 3XX/4XX/5XX response codes
@@ -2772,13 +2786,15 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
                     hts_log_print(opt, LOG_WARNING,
                                   "Previous file '%s' not found (erased by "
                                   "user ?), ignoring: %s%s",
-                                  save, back[p].url_adr, back[p].url_fil);
+                                  save, adr_nologin(opt, back[p].url_adr),
+                                  back[p].url_fil);
                   }
                 } else {
                   hts_log_print(opt, LOG_WARNING,
                                 "Previous file '%s' not found (erased by user "
                                 "?), recatching: %s%s",
-                                save, back[p].url_adr, back[p].url_fil);
+                                save, adr_nologin(opt, back[p].url_adr),
+                                back[p].url_fil);
                 }
               }
             } // fsize() <= 0
@@ -2823,11 +2839,11 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
             if (!test) {
               hts_log_print(opt, LOG_DEBUG,
                             "File immediately loaded from cache: %s%s",
-                            back[p].url_adr, back[p].url_fil);
+                            adr_nologin(opt, back[p].url_adr), back[p].url_fil);
             } else {
               hts_log_print(opt, LOG_DEBUG,
                             "File immediately tested from cache: %s%s",
-                            back[p].url_adr, back[p].url_fil);
+                            adr_nologin(opt, back[p].url_adr), back[p].url_fil);
             }
             back[p].r.notmodified = 1;  // fichier non modifié
             // no request was sent at all, so this is never a server 304 (#839)
@@ -2969,7 +2985,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
 #endif
               hts_log_print(opt, LOG_DEBUG,
                             "File partially present (" LLintP " bytes): %s%s",
-                            (LLint) sz, back[p].url_adr, back[p].url_fil);
+                            (LLint) sz, adr_nologin(opt, back[p].url_adr),
+                            back[p].url_fil);
 
               /* impossible - don't have etag or date
                  if (strnotempty(back[p].r.etag)) {  // ETag (RFC2616)
@@ -2990,16 +3007,18 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
                 back[p].range_req_size = sz;
               } else {
                 hts_log_print(opt, LOG_WARNING,
-                              "Could not find timestamp for partially present file, restarting (lost "
-                              LLintP " bytes): %s%s", (LLint) sz,
-                              back[p].url_adr, back[p].url_fil);
+                              "Could not find timestamp for partially present "
+                              "file, restarting (lost " LLintP " bytes): %s%s",
+                              (LLint) sz, adr_nologin(opt, back[p].url_adr),
+                              back[p].url_fil);
               }
 
             } else {
               hts_log_print(opt, LOG_NOTICE,
                             "File partially present (" LLintP
                             " bytes) retransferred due to lack of cache: %s%s",
-                            (LLint) sz, back[p].url_adr, back[p].url_fil);
+                            (LLint) sz, adr_nologin(opt, back[p].url_adr),
+                            back[p].url_fil);
               /* Sinon requête normale... */
               back[p].http11 = 0;
             }
@@ -3017,7 +3036,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
           hts_log_print(opt, LOG_NOTICE,
                         "HTML file (" LLintP
                         " bytes) retransferred due to lack of cache: %s%s",
-                        (LLint) sz, back[p].url_adr, back[p].url_fil);
+                        (LLint) sz, adr_nologin(opt, back[p].url_adr),
+                        back[p].url_fil);
           /* Sinon requête normale... */
           back[p].http11 = 0;
         }
@@ -3031,7 +3051,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
       back[p].status = STATUS_READY;    // terminé
       back_set_finished(opt, sback, p);
       hts_log_print(opt, LOG_WARNING,
-                    "File not added due to mirror cancel: %s%s", adr, fil);
+                    "File not added due to mirror cancel: %s%s",
+                    adr_nologin(opt, adr), fil);
       return 0;
     }
 
@@ -3161,7 +3182,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
 
         hts_log_print(opt, LOG_DEBUG,
                       "(Keep-Alive): successfully linked #%d (for %s%s)",
-                      back[p].r.debugid, back[p].url_adr, back[p].url_fil);
+                      back[p].r.debugid, adr_nologin(opt, back[p].url_adr),
+                      back[p].url_fil);
       }
 
       if (opt->timeout > 0) {   // gestion du opt->timeout
@@ -3256,8 +3278,8 @@ int back_add(struct_back *sback, httrackp *opt, cache_back *cache,
                 may_be_hypertext_mime(opt, back[i].r.contenttype,
                                       back[i].url_fil),
                 /* */
-                back[i].r.contenttype, back[i].url_adr, back[i].url_fil,
-                back[i].url_sav);
+                back[i].r.contenttype, adr_nologin(opt, back[i].url_adr),
+                back[i].url_fil, back[i].url_sav);
           }
         }
       }
@@ -3318,8 +3340,10 @@ void back_clean(httrackp * opt, cache_back * cache, struct_back * sback) {
             opt->liens[index]->pass2 = -1;        /* DONE! */
           } else {
             hts_log_print(opt, LOG_INFO,
-                          "engine: warning: entry cleaned up, but no trace on heap: %s%s (%s)",
-                          back[i].url_adr, back[i].url_fil, back[i].url_sav);
+                          "engine: warning: entry cleaned up, but no trace on "
+                          "heap: %s%s (%s)",
+                          adr_nologin(opt, back[i].url_adr), back[i].url_fil,
+                          back[i].url_sav);
           }
         }
         HTS_STAT.stat_background++;
@@ -3332,7 +3356,7 @@ void back_clean(httrackp * opt, cache_back * cache, struct_back * sback) {
           /* recycle the socket, but keep back[i].r.adr in memory */
           hts_log_print(opt, LOG_DEBUG,
                         "file %s%s validated (cached, left in memory)",
-                        back[i].url_adr, back[i].url_fil);
+                        adr_nologin(opt, back[i].url_adr), back[i].url_fil);
           back_maydeletehttp(opt, cache, sback, i);
         }
       }
@@ -3354,9 +3378,9 @@ void back_clean(httrackp * opt, cache_back * cache, struct_back * sback) {
                    (int) back[i].r.keep_alive_t);
           reason = buffer;
         }
-        hts_log_print(opt, LOG_DEBUG,
-                      "(Keep-Alive): live socket #%d (%s) closed (%s)",
-                      back[i].r.debugid, back[i].url_adr, reason);
+        hts_log_print(
+            opt, LOG_DEBUG, "(Keep-Alive): live socket #%d (%s) closed (%s)",
+            back[i].r.debugid, adr_nologin(opt, back[i].url_adr), reason);
         back_delete(opt, cache, sback, i);      // delete backing entry
       }
     }
@@ -4139,9 +4163,11 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
 #if HDEBUG
                             printf("direct-disk: %s\n", back[i].url_sav);
 #endif
-                            hts_log_print(opt, LOG_DEBUG,
-                                          "File received from net to disk: %s%s",
-                                          back[i].url_adr, back[i].url_fil);
+                            hts_log_print(
+                                opt, LOG_DEBUG,
+                                "File received from net to disk: %s%s",
+                                adr_nologin(opt, back[i].url_adr),
+                                back[i].url_fil);
 
                             if (back[i].r.out == NULL) {
                               hts_log_print(opt, LOG_ERROR | LOG_ERRNO,
@@ -4165,17 +4191,20 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                               /* create a temporary reference file in case of broken mirror */
                               if (back[i].r.out != NULL && opt->cache != 0) {
                                 if (back_serialize_ref(opt, &back[i]) != 0) {
-                                  hts_log_print(opt, LOG_WARNING,
-                                                "Could not create temporary reference file for %s%s",
-                                                back[i].url_adr,
-                                                back[i].url_fil);
+                                  hts_log_print(
+                                      opt, LOG_WARNING,
+                                      "Could not create temporary "
+                                      "reference file for %s%s",
+                                      adr_nologin(opt, back[i].url_adr),
+                                      back[i].url_fil);
                                 }
                               }
                             }
                           } else { // on coupe tout!
                             hts_log_print(opt, LOG_DEBUG,
                                           "File cancelled (non HTML): %s%s",
-                                          back[i].url_adr, back[i].url_fil);
+                                          adr_nologin(opt, back[i].url_adr),
+                                          back[i].url_fil);
                             back[i].status = STATUS_READY;      // terminé
                             back_set_finished(opt, sback, i);
                             if (!back[i].testmode)
@@ -4343,7 +4372,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                 hts_log_print(opt, LOG_WARNING,
                               "Truncated chunked transfer (" LLintP
                               " Bytes, terminating chunk missing) for %s%s",
-                              (LLint) back[i].r.size, back[i].url_adr,
+                              (LLint) back[i].r.size,
+                              adr_nologin(opt, back[i].url_adr),
                               back[i].url_fil);
               }
             }
@@ -4364,12 +4394,12 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                (LLint) back[i].r.totalsize);
                 } else {
                   // Un warning suffira..
-                  hts_log_print(opt, LOG_WARNING,
-                                "Incorrect length (" LLintP "!=" LLintP
-                                " expected) for %s%s",
-                                (LLint) back[i].r.size,
-                                (LLint) back[i].r.totalsize, back[i].url_adr,
-                                back[i].url_fil);
+                  hts_log_print(
+                      opt, LOG_WARNING,
+                      "Incorrect length (" LLintP "!=" LLintP
+                      " expected) for %s%s",
+                      (LLint) back[i].r.size, (LLint) back[i].r.totalsize,
+                      adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                 }
               }
             }
@@ -4463,7 +4493,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                         if (!hts_inmem_size_fits(back[i].r.totalsize)) {
                           hts_log_print(opt, LOG_WARNING,
                                         "Chunked resource too large for %s%s",
-                                        back[i].url_adr, back[i].url_fil);
+                                        adr_nologin(opt, back[i].url_adr),
+                                        back[i].url_fil);
                           chunk_size = -1;
                         } else {
                           char *const grown = (char *) realloct(
@@ -4479,7 +4510,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                           "not enough memory (" LLintP
                                           ") for %s%s",
                                           (LLint) back[i].r.totalsize,
-                                          back[i].url_adr, back[i].url_fil);
+                                          adr_nologin(opt, back[i].url_adr),
+                                          back[i].url_fil);
                             chunk_size = -1;
                           }
                         }
@@ -4490,10 +4522,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                              (LLint) back[i].r.totalsize);
 #endif
                     } else {
-                      hts_log_print(opt, LOG_WARNING,
-                                    "Illegal chunk (%s) for %s%s",
-                                    back[i].chunk_adr, back[i].url_adr,
-                                    back[i].url_fil);
+                      hts_log_print(
+                          opt, LOG_WARNING, "Illegal chunk (%s) for %s%s",
+                          back[i].chunk_adr, adr_nologin(opt, back[i].url_adr),
+                          back[i].url_fil);
                     }
                   } else { /* STATUS_CHUNK_CR: the CRLF after the data */
                     if (chunk_data[0] == '\0') {
@@ -4507,10 +4539,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                       printf("[%d] chunk CRLF seen\n", (int) back[i].r.soc);
 #endif
                     } else {
-                      hts_log_print(opt, LOG_WARNING,
-                                    "illegal chunk CRLF (%s) for %s%s",
-                                    back[i].chunk_adr, back[i].url_adr,
-                                    back[i].url_fil);
+                      hts_log_print(
+                          opt, LOG_WARNING, "illegal chunk CRLF (%s) for %s%s",
+                          back[i].chunk_adr, adr_nologin(opt, back[i].url_adr),
+                          back[i].url_fil);
 #if CHUNKDEBUG==1
                       printf("[%d] chunk CRLF ERROR!! : '%s'\n",
                              (int) back[i].r.soc, chunk_data);
@@ -4518,10 +4550,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     }
                   }
                 } else {
-                  hts_log_print(opt, LOG_WARNING,
-                                "chunk too big (" LLintP ") for %s%s",
-                                (LLint) back[i].chunk_size, back[i].url_adr,
-                                back[i].url_fil);
+                  hts_log_print(
+                      opt, LOG_WARNING, "chunk too big (" LLintP ") for %s%s",
+                      (LLint) back[i].chunk_size,
+                      adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                 }
 
                 // ok, continuer sur le body
@@ -4562,9 +4594,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     back_finalize(opt, cache, sback, i);
                   } else {
                     if (back[i].r.statuscode == HTTP_OK) {
-                      hts_log_print(opt, LOG_WARNING,
-                                    "unexpected incomplete type with 200 code at %s%s",
-                                    back[i].url_adr, back[i].url_fil);
+                      hts_log_print(
+                          opt, LOG_WARNING,
+                          "unexpected incomplete type with 200 code at %s%s",
+                          adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                     }
                   }
                   if (back[i].r.soc != INVALID_SOCKET) {
@@ -4598,11 +4631,12 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                           } else {
                             // Un warning suffira..
                             hts_log_print(opt, LOG_WARNING,
-                                          "Incorrect length (" LLintP "!="
-                                          LLintP " expected) for %s%s",
+                                          "Incorrect length (" LLintP
+                                          "!=" LLintP " expected) for %s%s",
                                           (LLint) back[i].r.size,
                                           (LLint) back[i].r.totalsize,
-                                          back[i].url_adr, back[i].url_fil);
+                                          adr_nologin(opt, back[i].url_adr),
+                                          back[i].url_fil);
                           }
                         }
                       }
@@ -4663,12 +4697,13 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
 #endif
                     if (_DEBUG_HEAD) {
                       if (ioinfo) {
-                        fprintf(ioinfo,
-                                "[%d] response for %s%s:\r\ncode=%d\r\n",
-                                back[i].r.debugid,
-                                jump_identification_const(back[i].url_adr),
-                                back[i].url_fil, back[i].r.statuscode);
-                        fprintfio(ioinfo, back[i].r.adr, ">>> ");
+                        hts_secret_fprintf(
+                            opt, ioinfo,
+                            "[%d] response for %s%s:\r\ncode=%d\r\n",
+                            back[i].r.debugid,
+                            jump_identification_const(back[i].url_adr),
+                            back[i].url_fil, back[i].r.statuscode);
+                        fprintfio(ioinfo, back[i].r.adr, ">>> ", opt);
                         fprintf(ioinfo, "\r\n");
                         fflush(ioinfo);
                       }         // en-tête
@@ -4685,7 +4720,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                            truncated Location, or read its tail as headers */
                         hts_log_print(opt, LOG_WARNING,
                                       "Over-long header dropped for %s%s",
-                                      back[i].url_adr, back[i].url_fil);
+                                      adr_nologin(opt, back[i].url_adr),
+                                      back[i].url_fil);
                         continue;
                       }
 #if HDEBUG
@@ -4736,8 +4772,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                                   &back[i].r);
                     if (test_head != 1) {
                       hts_log_print(opt, LOG_WARNING,
-                                    "External wrapper aborted transfer, breaking connection: %s%s",
-                                    back[i].url_adr, back[i].url_fil);
+                                    "External wrapper aborted transfer, "
+                                    "breaking connection: %s%s",
+                                    adr_nologin(opt, back[i].url_adr),
+                                    back[i].url_fil);
                       back[i].status = STATUS_READY;    // FINI
                       back_set_finished(opt, sback, i);
                       deletehttp(&back[i].r);
@@ -4773,7 +4811,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                   "Bot protection challenge at %s%s: the "
                                   "server refused the request (cf-mitigated "
                                   "header) rather than failing it",
-                                  back[i].url_adr, back[i].url_fil);
+                                  adr_nologin(opt, back[i].url_adr),
+                                  back[i].url_fil);
                     hts_log_print(opt, LOG_WARNING,
                                   "Solve the challenge in a browser, then pass "
                                   "its cookies with --cookies-file and its "
@@ -4799,9 +4838,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     back[i].r.msg[0] = '\0';
                     /* the interim block is not the final response's headers */
                     freet(back[i].r.headers);
-                    hts_log_print(opt, LOG_DEBUG,
-                                  "Status 100 detected for %s%s, continuing headers",
-                                  back[i].url_adr, back[i].url_fil);
+                    hts_log_print(
+                        opt, LOG_DEBUG,
+                        "Status 100 detected for %s%s, continuing headers",
+                        adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                     continue;
                   }
 
@@ -4834,7 +4874,7 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                           "Kept existing file %s (" LLintP
                           " bytes), matching size and timestamp: %s%s",
                           back[i].url_sav, (LLint) back[i].range_req_size,
-                          back[i].url_adr, back[i].url_fil);
+                          adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                     }
                   }
                   // transform 406 into 200 ; we'll catch embedded links inside the choice page
@@ -4847,12 +4887,12 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                       back[i].is_update && !back[i].testmode &&
                       back[i].range_req_size == 0 && back[i].url_sav[0] &&
                       fexist_utf8(back[i].url_sav)) {
-                    hts_log_print(opt, LOG_NOTICE,
-                                  "Kept existing file %s after error %d (%s) "
-                                  "on update: %s%s",
-                                  back[i].url_sav, back[i].r.statuscode,
-                                  back[i].r.msg, back[i].url_adr,
-                                  back[i].url_fil);
+                    hts_log_print(
+                        opt, LOG_NOTICE,
+                        "Kept existing file %s after error %d (%s) "
+                        "on update: %s%s",
+                        back[i].url_sav, back[i].r.statuscode, back[i].r.msg,
+                        adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                     back[i].r.statuscode = HTTP_NOT_MODIFIED;
                     deletehttp(&back[i].r);
                     back[i].r.soc = INVALID_SOCKET;
@@ -4896,14 +4936,17 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                   "Kept existing file %s (" LLintP
                                   " bytes), matching the cached size: %s%s",
                                   back[i].url_sav, (LLint) len1,
-                                  back[i].url_adr, back[i].url_fil);
+                                  adr_nologin(opt, back[i].url_adr),
+                                  back[i].url_fil);
                             }
                           }
                         } else {
-                          hts_log_print(opt, LOG_WARNING,
-                                        "File seems complete (same size), but there was a cache read error (%u): %s%s",
-                                        r.statuscode, back[i].url_adr,
-                                        back[i].url_fil);
+                          hts_log_print(
+                              opt, LOG_WARNING,
+                              "File seems complete (same size), but there was "
+                              "a cache read error (%u): %s%s",
+                              r.statuscode, adr_nologin(opt, back[i].url_adr),
+                              back[i].url_fil);
                         }
                         if (r.adr) {
                           freet(r.adr);
@@ -4939,7 +4982,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                               " bytes), matching the announced "
                                               "size: %s%s",
                                               back[i].url_sav, (LLint) size,
-                                              back[i].url_adr, back[i].url_fil);
+                                              adr_nologin(opt, back[i].url_adr),
+                                              back[i].url_fil);
                               }
                             }
                           }
@@ -4987,7 +5031,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                             "size, range ignored: %s%s",
                                             back[i].url_sav,
                                             (LLint) back[i].range_req_size,
-                                            back[i].url_adr, back[i].url_fil);
+                                            adr_nologin(opt, back[i].url_adr),
+                                            back[i].url_fil);
                                       }
                                     }
                                   }
@@ -5035,7 +5080,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                   // head: terminé
                   if (back[i].head_request) {
                     hts_log_print(opt, LOG_DEBUG, "Tested file: %s%s",
-                                  back[i].url_adr, back[i].url_fil);
+                                  adr_nologin(opt, back[i].url_adr),
+                                  back[i].url_fil);
 #if HTS_DEBUG_CLOSESOCK
                     DEBUG_W("back_wait(head request): deletehttp\n");
 #endif
@@ -5089,9 +5135,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                         get_httptype_sized(opt, back[i].r.contenttype,
                                            sizeof(back[i].r.contenttype),
                                            back[i].url_sav, 1);
-                        hts_log_print(opt, LOG_DEBUG,
-                                      "Not-modified status without cache guessed: %s%s",
-                                      back[i].url_adr, back[i].url_fil);
+                        hts_log_print(
+                            opt, LOG_DEBUG,
+                            "Not-modified status without cache guessed: %s%s",
+                            adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                       }
                     }
                     // Status is okay?
@@ -5104,7 +5151,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                           server_sent_304 ? HTS_FALSE : HTS_TRUE;
                       hts_log_print(opt, LOG_DEBUG,
                                     "File loaded after test from cache: %s%s",
-                                    back[i].url_adr, back[i].url_fil);
+                                    adr_nologin(opt, back[i].url_adr),
+                                    back[i].url_fil);
 
                       // finalize
                       if (back[i].r.statuscode > 0) {
@@ -5139,8 +5187,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                     hts_log_print(
                         opt, LOG_NOTICE,
                         "File excluded by MIME type filter (%s): %s%s",
-                        back[i].r.contenttype, back[i].url_adr,
-                        back[i].url_fil);
+                        back[i].r.contenttype,
+                        adr_nologin(opt, back[i].url_adr), back[i].url_fil);
                   } else { // il faut aller le chercher
 
                     // effacer buffer (requète)
@@ -5209,11 +5257,12 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                 /* create a temporary reference file in case of
                                  * broken mirror */
                                 if (back_serialize_ref(opt, &back[i]) != 0) {
-                                  hts_log_print(opt, LOG_WARNING,
-                                                "Could not create temporary "
-                                                "reference file for %s%s",
-                                                back[i].url_adr,
-                                                back[i].url_fil);
+                                  hts_log_print(
+                                      opt, LOG_WARNING,
+                                      "Could not create temporary "
+                                      "reference file for %s%s",
+                                      adr_nologin(opt, back[i].url_adr),
+                                      back[i].url_fil);
                                 }
 #if HDEBUG
                                 printf("continue interrupted file\n");
@@ -5285,8 +5334,9 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                                       "Unusable partial-content range for %s%s "
                                       "(have " LLintP " bytes, got " LLintP
                                       "-" LLintP "/" LLintP "), restarting",
-                                      back[i].url_adr, back[i].url_fil,
-                                      (LLint) sz, back[i].r.crange_start,
+                                      adr_nologin(opt, back[i].url_adr),
+                                      back[i].url_fil, (LLint) sz,
+                                      back[i].r.crange_start,
                                       back[i].r.crange_end, back[i].r.crange);
                         url_savename_refname_remove(opt, back[i].url_adr,
                                                     back[i].url_fil);
@@ -5409,12 +5459,13 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
         if (opt->verbosedisplay == HTS_VERBOSE_SIMPLE) {
           if (back_status(&back[i]) == STATUS_READY) {
             if (back[i].r.statuscode == HTTP_OK)
-              printf("* %s%s (" LLintP " bytes) - OK\n", back[i].url_adr,
-                     back[i].url_fil, (LLint) back[i].r.size);
+              printf("* %s%s (" LLintP " bytes) - OK\n",
+                     adr_nologin(opt, back[i].url_adr), back[i].url_fil,
+                     (LLint) back[i].r.size);
             else
-              printf("* %s%s (" LLintP " bytes) - %d\n", back[i].url_adr,
-                     back[i].url_fil, (LLint) back[i].r.size,
-                     back[i].r.statuscode);
+              printf("* %s%s (" LLintP " bytes) - %d\n",
+                     adr_nologin(opt, back[i].url_adr), back[i].url_fil,
+                     (LLint) back[i].r.size, back[i].r.statuscode);
             fflush(stdout);
           }
         }
@@ -5457,8 +5508,8 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
               }
             }
             if (((int) (act - back[i].timeout_refresh)) >= back[i].timeout) {
-              hts_log_print(opt, LOG_DEBUG, "connection timed out for %s%s", back[i].url_adr,
-                back[i].url_fil);
+              hts_log_print(opt, LOG_DEBUG, "connection timed out for %s%s",
+                            adr_nologin(opt, back[i].url_adr), back[i].url_fil);
               if (back[i].r.soc != INVALID_SOCKET) {
 #if HTS_DEBUG_CLOSESOCK
                 DEBUG_W("back_wait(timeout): deletehttp\n");
diff --git a/src/htsbauth.c b/src/htsbauth.c
index caac90c55..cfa664f1e 100644
--- a/src/htsbauth.c
+++ b/src/htsbauth.c
@@ -688,8 +688,7 @@ static hts_boolean cookie_flat_pair(httrackp *opt, t_cookie *cookie, char *pair,
   if (eq == NULL || eq == pair) {
     if (cookie_flat_ignore(ignored))
       hts_log_print(opt, LOG_WARNING,
-                    "Cookies: ignoring a cookie with no name in %s: %.64s",
-                    given, pair);
+                    "Cookies: ignoring a cookie with no name in %s", given);
     return HTS_FALSE;
   }
   *eq = '\0';
@@ -941,6 +940,7 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,
       char BIGSTK line[8192];
       const size_t line_max = 8000;
       hts_boolean first_line = HTS_TRUE;
+      int lineno = 0;
       // this load's records alone, so a line repeating one is caught
       t_cookie *seen = (t_cookie *) calloct(1, sizeof(t_cookie));
 
@@ -958,6 +958,8 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,
 
         // len counts what the buffer cut too, so this catches that line
         cookie_readline(fp, line, sizeof(line), &len);
+        if (lineno < INT_MAX)
+          lineno++;
         if (first_line && len >= sizeof(cookie_bom) - 1 &&
             strncmp(line, cookie_bom, sizeof(cookie_bom) - 1) == 0) {
           len -= sizeof(cookie_bom) - 1;
@@ -987,9 +989,11 @@ int cookie_load_from(httrackp *opt, t_cookie *cookie, const char *fpath,
 
           if (rec[0] == '#') {
             if (!cookie_known_comment(rec)) {
+              // no line text, because any part of it can hold a cookie value
               hts_log_print(opt, LOG_WARNING,
-                            "Cookies: ignoring an unknown comment in %s: %.64s",
-                            given, rec);
+                            "Cookies: ignoring an unknown comment on line %d "
+                            "of %s",
+                            lineno, given);
               refused++;
             }
           } else {
diff --git a/src/htscache.c b/src/htscache.c
index a71f76c48..0e7eb2473 100644
--- a/src/htscache.c
+++ b/src/htscache.c
@@ -53,16 +53,18 @@ Please visit our Website: http://www.httrack.com
 void cache_mayadd(httrackp * opt, cache_back * cache, htsblk * r,
                   const char *url_adr, const char *url_fil,
                   const char *url_save) {
-  hts_log_print(opt, LOG_DEBUG, "File checked by cache: %s", url_adr);
+  hts_log_print(opt, LOG_DEBUG, "File checked by cache: %s",
+                adr_nologin(opt, url_adr));
   // ---stockage en cache---
   // stocker dans le cache?
   if (opt->cache) {
     if (cache_writable(cache)) {
       // ensure not a temporary filename (should not happend ?!)
       if (IS_DELAYED_EXT(url_save)) {
-        hts_log_print(opt, LOG_WARNING,
-                      "aborted cache validation: %s%s still has temporary name %s",
-                      url_adr, url_fil, url_save);
+        hts_log_print(
+            opt, LOG_WARNING,
+            "aborted cache validation: %s%s still has temporary name %s",
+            adr_nologin(opt, url_adr), url_fil, url_save);
         return;
       }
       // c'est le seul endroit ou l'on ajoute des elements dans le cache (fichier entier ou header)
@@ -105,9 +107,9 @@ void cache_mayadd(httrackp * opt, cache_back * cache, htsblk * r,
                   strcatbuff(tempo, "\n");
                   strcatbuff(tempo, r->location);
                 }
-                hts_log_print(opt, LOG_DEBUG,
-                              "Cached fast-header response: %s%s is %d",
-                              url_adr, url_fil, (int) r->statuscode);
+                hts_log_print(
+                    opt, LOG_DEBUG, "Cached fast-header response: %s%s is %d",
+                    adr_nologin(opt, url_adr), url_fil, (int) r->statuscode);
                 coucal_add(cache->cached_tests,
                             concat(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), url_adr, url_fil),
                             (intptr_t) strdupt(tempo));
@@ -207,9 +209,10 @@ static void cache_zip_write_failed(httrackp *opt, cache_back *cache,
     /* fatal: stop the mirror, exit non-zero */
     hts_store_release_int(&opt->state.exit_xh, -1);
   } else {
-    hts_log_print(
-        opt, LOG_WARNING, "cache write failed (%s: %s), entry not cached: %s%s",
-        what, hts_get_zerror(zErr, errbuf, sizeof(errbuf)), url_adr, url_fil);
+    hts_log_print(opt, LOG_WARNING,
+                  "cache write failed (%s: %s), entry not cached: %s%s", what,
+                  hts_get_zerror(zErr, errbuf, sizeof(errbuf)),
+                  adr_nologin(opt, url_adr), url_fil);
   }
 }
 
@@ -274,7 +277,7 @@ void cache_keep_previous(httrackp *opt, cache_back *cache, const char *url_adr,
      URL's file. */
   if (r.statuscode > 0 && strcmp(previous_save, url_save) == 0) {
     hts_log_print(opt, LOG_DEBUG, "keeping the previous cache entry for %s%s",
-                  url_adr, url_fil);
+                  adr_nologin(opt, url_adr), url_fil);
     cache_add_ex(opt, cache, &r, url_adr, url_fil, url_save, opt->all_in_cache,
                  StringBuff(opt->path_html_utf8), HTS_TRUE);
   }
@@ -336,12 +339,12 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
     if (r->is_write && url_save != NULL && strnotempty(url_save)) {
       hts_log_print(opt, LOG_WARNING,
                     "file too large for the cache, storing headers only: %s%s",
-                    url_adr, url_fil);
+                    adr_nologin(opt, url_adr), url_fil);
       dataincache = 0;
     } else {
       hts_log_print(opt, LOG_WARNING,
-                    "entry too large for the cache, not cached: %s%s", url_adr,
-                    url_fil);
+                    "entry too large for the cache, not cached: %s%s",
+                    adr_nologin(opt, url_adr), url_fil);
       return;
     }
   }
@@ -407,7 +410,7 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
   if (headersDropped != 0) {
     hts_log_print(opt, LOG_WARNING,
                   "cached headers too large, %d field(s) dropped: %s%s",
-                  headersDropped, url_adr, url_fil);
+                  headersDropped, adr_nologin(opt, url_adr), url_fil);
   }
 
   /* Filename */
@@ -421,7 +424,7 @@ static void cache_add_ex(httrackp *opt, cache_back *cache, const htsblk *r,
                          url_fil)) {
       hts_log_print(opt, LOG_WARNING,
                     "URL too long to be cached, entry not cached: %s%s",
-                    url_adr, url_fil);
+                    adr_nologin(opt, url_adr), url_fil);
       return;
     }
   }
@@ -720,7 +723,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
           if (!hts_location_is_safe(r.location)) {
             hts_log_print(opt, LOG_WARNING,
                           "cached Location naming a post token, dropped: %s%s",
-                          adr, fil);
+                          adr_nologin(opt, adr), fil);
             r.location[0] = '\0';
           }
 
@@ -750,7 +753,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
               hts_log_print(opt, LOG_WARNING,
                             "cached filename leaving the mirror, "
                             "not using the cache entry: %s%s",
-                            adr, fil);
+                            adr_nologin(opt, adr), fil);
               r.statuscode = STATUSCODE_INVALID;
               strcpybuff(r.msg, "Cache Read Error : Bad Filename");
             }
@@ -761,7 +764,7 @@ static htsblk cache_readex_new(httrackp *opt, cache_back *cache,
               hts_log_print(opt, LOG_WARNING,
                             "cached filename too long once rebuilt under '%s', "
                             "not using the cache entry: %s%s",
-                            path_html, adr, fil);
+                            path_html, adr_nologin(opt, adr), fil);
               r.statuscode = STATUSCODE_INVALID;
               strcpybuff(r.msg, "Cache Read Error : Filename Too Long");
             }
diff --git a/src/htscore.c b/src/htscore.c
index fc198a27c..66d15e86e 100644
--- a/src/htscore.c
+++ b/src/htscore.c
@@ -385,8 +385,11 @@ int hts_record_link(httrackp * opt,
                     const char *address, const char *file, const char *save,
                     const char *ref_address, const char *ref_file,
                     const char *codebase) {
-  const int success = 
-    hts_record_link_(opt, address, file, save, ref_address, ref_file, codebase);
+  int success;
+
+  hts_secret_add_login(opt, address);
+  success = hts_record_link_(opt, address, file, save, ref_address, ref_file,
+                             codebase);
   if (!success && opt->maxlink > 0 && opt->lien_tot >= opt->maxlink) {
     hts_log_print(opt, LOG_PANIC, "Too many links (links=%ld, limit=%ld)", 
                   (long int) heap_top_index(), (long int) opt->maxlink);
@@ -988,10 +991,10 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
         // prochaine adresse
         if (!hts_scan_token(&a, url, sizeof(url))) {
           printf("URL longer than %d bytes, ignored: %.64s...\n",
-                 (int) (sizeof(url) - 1), url);
+                 (int) (sizeof(url) - 1), url_nologin(opt, url));
           hts_log_print(opt, LOG_WARNING,
                         "URL longer than %d bytes, ignored: %.64s...",
-                        (int) (sizeof(url) - 1), url);
+                        (int) (sizeof(url) - 1), url_nologin(opt, url));
           continue;
         }
 
@@ -1013,7 +1016,8 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
       else
         strcpybuff(url, StringBuff(opt->why_url));
       if (ident_url_absolute(url, &af) < 0) {
-        printf("--why: unable to parse URL %s" LF, StringBuff(opt->why_url));
+        printf("--why: unable to parse URL %s" LF,
+               adr_nologin(opt, StringBuff(opt->why_url)));
       } else {
         char *const query = af.fil + strcspn(af.fil, "?");
         char BIGSTK path[sizeof(af.fil)];
@@ -1030,15 +1034,15 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
             filters_match_url(filters, filptr, af.adr, af.fil, &jokDepth);
 
         if (jok > 0)
-          printf("%s: accepted by rule #%d (%s)" LF, url, jokDepth + 1,
-                 filters[jokDepth]);
+          printf("%s: accepted by rule #%d (%s)" LF, url_nologin(opt, url),
+                 jokDepth + 1, filters[jokDepth]);
         else if (jok < 0)
-          printf("%s: rejected by rule #%d (%s)" LF, url, jokDepth + 1,
-                 filters[jokDepth]);
+          printf("%s: rejected by rule #%d (%s)" LF, url_nologin(opt, url),
+                 jokDepth + 1, filters[jokDepth]);
         else
           printf("%s: no filter rule matches; the wizard decides "
                  "(same-site links are followed by default)" LF,
-                 url);
+                 url_nologin(opt, url));
       }
       freet(primary);
       /* --why answered; no mirror was asked for. The store comes first
@@ -1127,9 +1131,9 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
             continue;
           }
           if (hts_is_quoted(line, strlen(line))) {
-            hts_log_print(opt, LOG_ERROR,
-                          "\"%s\", line %d: %s is quoted, ignored",
-                          StringBuff(opt->filelist), lineno, line);
+            hts_log_print(
+                opt, LOG_ERROR, "\"%s\", line %d: \"%s is quoted, ignored",
+                StringBuff(opt->filelist), lineno, adr_nologin(opt, line + 1));
             continue;
           }
           if (line[0]) {
@@ -1402,14 +1406,15 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
               )
           ) {                   // sauter si lien annulé (ou fil vide)
           if (heap(ptr) != NULL && heap(ptr)->pass2 == -1) {
-            hts_log_print(opt, LOG_DEBUG, "link #%d is ready, skipping: %s%s..",
-                          ptr, ((urladr() != NULL) ? (urladr()) : (" ")),
-                          ((urlfil() != NULL) ? (urlfil()) : (" ")));
+            hts_log_print(
+                opt, LOG_DEBUG, "link #%d is ready, skipping: %s%s..", ptr,
+                ((urladr() != NULL) ? adr_nologin(opt, urladr()) : (" ")),
+                ((urlfil() != NULL) ? (urlfil()) : (" ")));
           } else {
-            hts_log_print(opt, LOG_DEBUG,
-                          "link #%d seems ready, skipping: %s%s..", ptr,
-                          ((urladr() != NULL) ? (urladr()) : (" ")),
-                          ((urlfil() != NULL) ? (urlfil()) : (" ")));
+            hts_log_print(
+                opt, LOG_DEBUG, "link #%d seems ready, skipping: %s%s..", ptr,
+                ((urladr() != NULL) ? adr_nologin(opt, urladr()) : (" ")),
+                ((urlfil() != NULL) ? (urlfil()) : (" ")));
           }
           // remove from stats
           if (heap(ptr)->pass2 == -1) {
@@ -1424,7 +1429,8 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
       }
       if (heap(ptr) != NULL) { // on a qq chose à récupérer?
 
-        hts_log_print(opt, LOG_DEBUG, "Wait get: %s%s", urladr(), urlfil());
+        hts_log_print(opt, LOG_DEBUG, "Wait get: %s%s",
+                      adr_nologin(opt, urladr()), urlfil());
 #if DEBUG_ROBOTS
         if (strcmp(urlfil(), "/robots.txt") == 0) {
           printf("robots.txt detected\n");
@@ -1544,9 +1550,10 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
           if (istoobig(opt, r.totalsize, opt->maxfile_html,
                        opt->maxfile_nonhtml, r.contenttype)) {
             error = 0;
-            hts_log_print(opt, LOG_WARNING,
-                          "Big file cancelled according to user's preferences: %s%s",
-                          urladr(), urlfil());
+            hts_log_print(
+                opt, LOG_WARNING,
+                "Big file cancelled according to user's preferences: %s%s",
+                adr_nologin(opt, urladr()), urlfil());
           }
         }
       }
@@ -1599,9 +1606,9 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
           is_loaded_from_file = 1; \
           r.adr = readfile2_inmem(savename(), &r.size); \
           if (r.adr != NULL) { \
-            hts_log_print(opt, LOG_INFO, "File successfully loaded for parsing: %s%s (%d bytes)",urladr(),urlfil(),(int)r.size); \
+            hts_log_print(opt, LOG_INFO, "File successfully loaded for parsing: %s%s (%d bytes)",adr_nologin(opt, urladr()),urlfil(),(int)r.size); \
           } else { \
-            hts_log_print(opt, LOG_ERROR, "File could not be loaded for parsing: %s%s",urladr(),urlfil()); \
+            hts_log_print(opt, LOG_ERROR, "File could not be loaded for parsing: %s%s",adr_nologin(opt, urladr()),urlfil()); \
           } \
         } \
 } while(0)
@@ -1655,7 +1662,7 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
                 hts_log_print(
                     opt, LOG_ERROR,
                     "Not enough memory to convert %s%s from UCS2 to UTF-8",
-                    urladr(), urlfil());
+                    adr_nologin(opt, urladr()), urlfil());
                 r.statuscode = STATUSCODE_INVALID;
                 strcpybuff(r.msg, "Not enough memory");
                 error = 1;
@@ -1663,7 +1670,8 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
                 hts_log_print(opt, LOG_WARNING,
                               "File %s%s converted from UCS2 to UTF-8 (old "
                               "size: %d bytes, new size: %d bytes)",
-                              urladr(), urlfil(), (int) r.size, (int) new_size);
+                              adr_nologin(opt, urladr()), urlfil(),
+                              (int) r.size, (int) new_size);
                 freet(r.adr);
                 r.adr = new_adr;
                 r.size = (LLint) new_size;
@@ -1678,8 +1686,8 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
               is_binary = 1;
               strcpybuff(r.contenttype, "application/octet-stream");
               hts_log_print(opt, LOG_WARNING,
-                            "File not parsed, looks like binary: %s%s", urladr(),
-                            urlfil());
+                            "File not parsed, looks like binary: %s%s",
+                            adr_nologin(opt, urladr()), urlfil());
             }
 
             /* This hack allows you to avoid problems with parsing '\0' characters  */
@@ -1912,13 +1920,13 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
             if (page_charset[0] == '\0') {
               hts_log_print(opt, LOG_INFO,
                             "Warning: could not detect encoding for: %s%s",
-                            urladr(), urlfil());
+                            adr_nologin(opt, urladr()), urlfil());
             }
           }
 
           /* Info for wrappers */
-          hts_log_print(opt, LOG_INFO, "engine: check-html: %s%s", urladr(),
-                        urlfil());
+          hts_log_print(opt, LOG_INFO, "engine: check-html: %s%s",
+                        adr_nologin(opt, urladr()), urlfil());
           {
             char BIGSTK buff_err_msg[1024];
             htsmoduleStruct BIGSTK str;
@@ -2017,10 +2025,12 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
               if (strnotempty(infobuff)) {
                 hts_log_print(opt, LOG_INFO,
                               "Note: robots.txt forbidden links for %s are: %s",
-                              urladr(), infobuff);
+                              adr_nologin(opt, urladr()), infobuff);
                 hts_log_print(opt, LOG_NOTICE,
-                              "Note: due to %s remote robots.txt rules, links beginning with these path will be forbidden: %s (see in the options to disable this)",
-                              urladr(), infobuff);
+                              "Note: due to %s remote robots.txt rules, links "
+                              "beginning with these path will be forbidden: %s "
+                              "(see in the options to disable this)",
+                              adr_nologin(opt, urladr()), infobuff);
               }
             }
             /* After robots_parse, so the rules this very body carries already
@@ -2078,7 +2088,7 @@ int httpmirror(char *url1, httrackp *opt, hts_boolean *completed_out) {
             } else { // lien non autorisé! (ex: cgi-bin en html)
               hts_log_print(opt, LOG_DEBUG,
                             "non-html file ignored after upload at %s : %s",
-                            urladr(), urlfil());
+                            adr_nologin(opt, urladr()), urlfil());
               if (r.adr) {
                 freet(r.adr);
                 r.adr = NULL;
@@ -2626,8 +2636,8 @@ void host_ban(httrackp * opt, int ptr,
         back[i].r.soc = INVALID_SOCKET;
         back[i].r.statuscode = STATUSCODE_TIMEOUT;      // timeout (peu importe si c'est un traffic jam)
         strcpybuff(back[i].r.msg, "Link Cancelled by host control");
-        hts_log_print(opt, LOG_DEBUG, "Shutdown: %s%s", back[i].url_adr,
-                      back[i].url_fil);
+        hts_log_print(opt, LOG_DEBUG, "Shutdown: %s%s",
+                      adr_nologin(opt, back[i].url_adr), back[i].url_fil);
       }
   }
 
@@ -2642,8 +2652,8 @@ void host_ban(httrackp * opt, int ptr,
           l++;
         if ((l > 0) && (l < 1020)) { // in range
           if (strfield2(jump_identification_const(heap(i)->adr), host)) {    // host
-            hts_log_print(opt, LOG_DEBUG, "Cancel: %s%s", heap(i)->adr,
-                          heap(i)->fil);
+            hts_log_print(opt, LOG_DEBUG, "Cancel: %s%s",
+                          adr_nologin(opt, heap(i)->adr), heap(i)->fil);
             hts_invalidate_link(opt, i);  // invalidate hashtable entry
             // on efface pas le hash, because si on rencontre le lien, reverif sav..
           }
@@ -2762,7 +2772,8 @@ static hts_boolean live_cancel_link_(httrackp *opt, struct_back *sback, int i) {
     /* no cache: a dropped page must not be recorded as fetched */
     back_delete(opt, NULL, sback, b);
   }
-  hts_log_print(opt, LOG_DEBUG, "Cancel: %s%s", heap(i)->adr, heap(i)->fil);
+  hts_log_print(opt, LOG_DEBUG, "Cancel: %s%s", adr_nologin(opt, heap(i)->adr),
+                heap(i)->fil);
   hts_invalidate_link(opt, i);
   /* the main loop takes every cancelled link out of this count */
   HTS_STAT.stat_background++;
@@ -4508,6 +4519,7 @@ HTSEXT_API int hts_is_exiting(httrackp * opt) {
 
 // message d'erreur?
 char *hts_errmsg(httrackp * opt) {
+  hts_hide_secrets(opt, opt->state._hts_errmsg, sizeof(opt->state._hts_errmsg));
   return opt->state._hts_errmsg;
 }
 
@@ -4841,18 +4853,19 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
 
     codebase[0] = '\0';
 
-    hts_log_print(opt, LOG_DEBUG, "(module): adding link : '%s'", link);
+    hts_log_print(opt, LOG_DEBUG, "(module): adding link : '%s'",
+                  url_nologin(opt, link));
     // recopie de "creer le lien"
     //    
 
     if (!RUN_CALLBACK1(opt, linkdetected, link)) {
       hts_log_print(opt, LOG_ERROR, "Link %s refused by external wrapper",
-                    link);
+                    url_nologin(opt, link));
       return 0;
     }
     if (!RUN_CALLBACK2(opt, linkdetected2, link, NULL)) {
       hts_log_print(opt, LOG_ERROR, "Link %s refused by external wrapper(2)",
-                    link);
+                    url_nologin(opt, link));
       return 0;
     }
     // adr = c'est la même
@@ -4884,14 +4897,14 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
           strcpybuff(codebase, tempo);  // couper host
         } else {
           hts_log_print(opt, LOG_ERROR, "Unexpected strstr error in base %s",
-                        codebase);
+                        url_nologin(opt, codebase));
         }
       }
     }
 
     if (!((int) strlen(codebase) < HTS_URLMAXSIZE)) {   // trop long
       hts_log_print(opt, LOG_ERROR, "Codebase too long, parsing skipped (%s)",
-                    codebase);
+                    url_nologin(opt, codebase));
     }
 
     {
@@ -4943,9 +4956,11 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
               if (savename()) {
                 if (lienrelatif(tempo, sizeof(tempo), afs.save, savename()) ==
                     0) {
-                  hts_log_print(opt, LOG_DEBUG,
-                                "(module): relative link at %s build with %s and %s: %s",
-                                afs.af.adr, afs.save, savename(), tempo);
+                  hts_log_print(
+                      opt, LOG_DEBUG,
+                      "(module): relative link at %s build with %s and %s: %s",
+                      adr_nologin(opt, afs.af.adr), afs.save, savename(),
+                      tempo);
                   if (str->localLink
                       && str->localLinkSize > (int) strlen(tempo) + 1) {
                     strlcpybuff(str->localLink, tempo, str->localLinkSize);
@@ -4957,7 +4972,7 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
 
           if (forbidden_url) {
             hts_log_print(opt, LOG_DEBUG, "(module): file not caught: %s",
-                          lien);
+                          url_nologin(opt, lien));
             if (str->localLink
                 && str->localLinkSize > (int) (strlen(afs.af.adr) + strlen(afs.af.fil) + 8)) {
               htsbuff lb = htsbuff_ptr(str->localLink, str->localLinkSize);
@@ -4970,8 +4985,9 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
           }
           //
           if (r != -1) {
-            hts_log_print(opt, LOG_DEBUG, "(module): %s%s -> %s (base %s)", afs.af.adr,
-                          afs.af.fil, afs.save, codebase);
+            hts_log_print(opt, LOG_DEBUG, "(module): %s%s -> %s (base %s)",
+                          adr_nologin(opt, afs.af.adr), afs.af.fil, afs.save,
+                          url_nologin(opt, codebase));
 
             // modifié par rapport à l'autre version (cf prio_fix notamment et save2)
 
@@ -5016,9 +5032,8 @@ int htsAddLink(htsmoduleStruct * str, char *link) {
               heap_top()->retry = opt->retry;
 
               hts_log_print(opt, LOG_DEBUG, "(module): OK, NOTE: %s%s -> %s",
-                            heap_top()->adr, heap_top()->fil,
+                            adr_nologin(opt, heap_top()->adr), heap_top()->fil,
                             heap_top()->sav);
-
             }
           }
         }
diff --git a/src/htscoremain.c b/src/htscoremain.c
index 5f37eb582..28f1d188f 100644
--- a/src/htscoremain.c
+++ b/src/htscoremain.c
@@ -312,13 +312,35 @@ static void cmdl_panic_value(httrackp *opt, const char *msg,
                              const char *value) {
   char s[HTS_CDLMAXSIZE * 2 + 256];
 
+  char shown[HTS_CDLMAXSIZE];
+
   if (hts_is_quoted(value, strlen(value)))
-    snprintf(s, sizeof(s), "%s: %s " HTS_QUOTED_HINT, msg, value);
+    snprintf(s, sizeof(s), "%s: \"%s " HTS_QUOTED_HINT, msg,
+             adr_nologin_r(shown, sizeof(shown), value + 1));
   else
     snprintf(s, sizeof(s), "%s", msg);
   HTS_PANIC_PRINTF(s);
 }
 
+/* Prints a --host-alias rule with the login of each of its names masked. */
+static void print_rule_nologin(const char *rule) {
+  while (*rule != '\0') {
+    char tok[HTS_CDLMAXSIZE];
+    char shown[HTS_CDLMAXSIZE + 8];
+    size_t n = strcspn(rule, ",=");
+
+    if (n >= sizeof(tok))
+      n = sizeof(tok) - 1;
+    memcpy(tok, rule, n);
+    tok[n] = '\0';
+    fputs(adr_nologin_r(shown, sizeof(shown), tok), stdout);
+    rule += n;
+    if (*rule == ',' || *rule == '=')
+      putchar(*rule++);
+  }
+  putchar('\n');
+}
+
 /* Panic on com, the end of option arg that no option takes. When com is
    quoted, the message names the option before it. */
 static void cmdl_bad_option(httrackp *opt, const char *arg, const char *prefix,
@@ -385,6 +407,7 @@ static hts_boolean write_progress_lock(httrackp *opt, const char *path,
 
 static int hts_main_internal(int argc, char **argv, httrackp * opt);
 static hts_boolean cmdl_shortopt_has(const char *s, char c);
+static hts_boolean cmdl_shortopt_named(const char *s, const char *opt);
 static void cmdl_doit_line(String *line, const cmdl_argv *cmd);
 
 // Main, récupère les paramètres et appelle le robot
@@ -551,6 +574,32 @@ static void cmdl_print_cache_entry(httrackp *opt, cache_back *cache,
   freet(r.adr);
 }
 
+/* Feeds the log backstop the passwords of the blank-separated start URLs,
+   but not of the +/- filters among them, of the proxy and --why, and the
+   secret -%X values. */
+static void hts_secret_learn_options(httrackp *opt, const char *urls) {
+  const char *u = urls;
+
+  while (*u != '\0') {
+    const size_t n = strcspn(u, " \t\r\n");
+
+    if (n != 0 && *u != '+' && *u != '-') {
+      char *word = malloct(n + 1);
+
+      if (word != NULL) {
+        memcpy(word, u, n);
+        word[n] = '\0';
+        hts_secret_add_login(opt, word);
+        freet(word);
+      }
+    }
+    u += n != 0 ? n : 1;
+  }
+  hts_secret_add_login(opt, StringBuff(opt->proxy.name));
+  hts_secret_add_login(opt, StringBuff(opt->why_url));
+  hts_secret_add_headers(opt, StringBuff(opt->headers));
+}
+
 static int hts_main_internal(int argc, char **argv, httrackp * opt) {
   /* command line rebuilt from argv, config files and doit.log */
   cmdl_argv x_cmd = {NULL, NULL, NULL, 0, 0, {NULL, 0, 0}};
@@ -2044,8 +2093,12 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                     const char *const why = http_custom_header_warning(
                         StringBuff(opt->headers), argv[na]);
 
-                    if (why != NULL)
-                      fprintf(stderr, "warning: -%%X %s: %s\n", why, argv[na]);
+                    // with the -%H log's redaction of a login header
+                    if (why != NULL) {
+                      fprintf(stderr, "warning: -%%X %s: ", why);
+                      fprintfio(stderr, argv[na], "", opt);
+                      fputc('\n', stderr);
+                    }
                   }
                   /* A refused line goes in, so the request drops its folds. */
                   if (StringNotEmpty(opt->headers) ||
@@ -2236,7 +2289,8 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                   if (!hts_host_alias_rule_ok(argv[na])) {
                     HTS_PANIC_PRINTF("Invalid host-alias rule: expected "
                                      "alias[,alias...]=canonical-host");
-                    printf("Rejected: %s\n", argv[na]);
+                    printf("Rejected: ");
+                    print_rule_nologin(argv[na]);
                     printf("Each side names a host, optionally behind its "
                            "scheme; a path is not part of an address\n");
                     htsmain_free();
@@ -2997,6 +3051,8 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
     // un petit lock-file pour indiquer un miroir en cours, ainsi qu'un éventuel fichier log
     {
       char t[256];
+      char *masked_url;
+      const char *shown_url;
 
       time_local_rfc822(t);     // faut bien que ca serve quelque part l'heure RFC1945 arf'
 
@@ -3107,20 +3163,47 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                         "engine: could not create hts-in_progress.lock, so"
                         " this mirror cannot be stopped or paused by a file");
       }
-      // fichier log        
+      hts_secret_learn_options(opt, url);
+      masked_url = hts_mask_passwords(url, HTS_MASK_LIST);
+      shown_url = masked_url != NULL ? masked_url : "(out of memory)";
+      // hts-log.txt
       if (opt->log) {
-        int i;
+        int i, opt_at = 0;
 
         fprintf(opt->log,
                 "HTTrack" HTTRACK_VERSION "%s launched on %s at %s" LF,
-                hts_get_version_info(opt), t, url);
+                hts_get_version_info(opt), t, shown_url);
         fprintf(opt->log, "(");
         for(i = 0; i < argc; i++) {
           const char *arg = argv[i]; // already UTF-8 on every platform
-          if (strchr(arg, ' ') == NULL || strchr(arg, '\"') != NULL)
-            fprintf(opt->log, "%s ", arg);
-          else                  // entre "" (si espace(s) et pas déja de ")
-            fprintf(opt->log, "\"%s\" ", arg);
+          // quoted if it holds a blank and no quote
+          const hts_boolean quote =
+              strchr(arg, ' ') != NULL && strchr(arg, '\"') == NULL;
+          // a start URL, or a -P, -%mu, -%R or --why value, is one address
+          hts_boolean addr;
+          char *masked;
+
+          if (x_cmd.span[i] != 0) {
+            opt_at = x_cmd.span[i] > 1 ? i : 0;
+            addr = HTS_FALSE;
+          } else if (opt_at != 0 && i < opt_at + x_cmd.span[opt_at]) {
+            addr = cmdl_shortopt_has(argv[opt_at], 'P') ||
+                   cmdl_shortopt_named(argv[opt_at], "-%mu") ||
+                   cmdl_shortopt_named(argv[opt_at], "-%R") ||
+                   cmdl_shortopt_named(argv[opt_at], "-%Y");
+          } else {
+            opt_at = 0;
+            addr = i != 0 && arg[0] != '+' && arg[0] != '-';
+          }
+          masked = addr ? hts_mask_passwords(arg, HTS_MASK_ADDR) : NULL;
+
+          if (quote)
+            fputc('"', opt->log);
+          // a -%X login header gets the -%H log's redaction
+          if (!addr || masked != NULL)
+            fprintfio(opt->log, addr ? masked : arg, "", opt);
+          fputs(quote ? "\" " : " ", opt->log);
+          freet(masked);
         }
         fprintf(opt->log, ")" LF);
         fprintf(opt->log, LF);
@@ -3136,14 +3219,15 @@ static int hts_main_internal(int argc, char **argv, httrackp * opt) {
                HTTRACK_VERSION "%s " HTTRACK_AFF_AUTHORS "" LF, t,
                hts_get_version_info(opt));
         if (opt->wizard == HTS_WIZARD_NONE) {
-          printf
-            ("mirroring %s with %d levels, %d sockets,t=%d,s=%d,logm=%d,lnk=%d,mdg=%d\n",
-             url, opt->depth, opt->maxsoc, opt->travel, opt->seeker,
-             httrack_logmode, opt->urlmode, opt->getmode);
+          printf("mirroring %s with %d levels, %d "
+                 "sockets,t=%d,s=%d,logm=%d,lnk=%d,mdg=%d\n",
+                 shown_url, opt->depth, opt->maxsoc, opt->travel, opt->seeker,
+                 httrack_logmode, opt->urlmode, opt->getmode);
         } else { // the magic wizard
-          printf("mirroring %s with the wizard help..\n", url);
+          printf("mirroring %s with the wizard help..\n", shown_url);
         }
       }
+      freet(masked_url);
     }
 
     io_flush;
@@ -3435,13 +3519,20 @@ static void cmdl_doit_line(String *line, const cmdl_argv *cmd) {
 /* Does the short-option cluster s carry c from the main option set (-i, -iC2,
    -%Mi)? The i of -%i belongs to another set. */
 static hts_boolean cmdl_shortopt_has(const char *s, char c) {
+  const char opt[3] = {'-', c, '\0'};
+
+  return cmdl_shortopt_named(s, opt);
+}
+
+/* Does the short option cluster s hold the option opt, such as "-%mu"? */
+static hts_boolean cmdl_shortopt_named(const char *s, const char *opt) {
   char name[8];
   size_t at = 1;
 
   if (s[0] != '-' || s[1] == '-')
     return HTS_FALSE;
   while (optcluster_next(s, &at, name, sizeof(name)))
-    if (name[1] == c && name[2] == '\0')
+    if (strcmp(name, opt) == 0)
       return HTS_TRUE;
   return HTS_FALSE;
 }
diff --git a/src/htsftp.c b/src/htsftp.c
index 338fffa97..dee8b47d6 100644
--- a/src/htsftp.c
+++ b/src/htsftp.c
@@ -639,7 +639,7 @@ static hts_boolean ftp_may_resume(httrackp *opt, const lien_back *back,
   if (back->r.totalsize <= back->range_req_size) {
     hts_log_print(opt, LOG_DEBUG,
                   "FTP: not resuming %s%s, the local copy is not shorter",
-                  back->url_adr, back->url_fil);
+                  adr_nologin(opt, back->url_adr), back->url_fil);
     return HTS_FALSE;
   }
   /* Equality, not ordering: a copy this code did not stamp carries a local
@@ -648,7 +648,7 @@ static hts_boolean ftp_may_resume(httrackp *opt, const lien_back *back,
       remote_mtime != local_mtime) {
     hts_log_print(opt, LOG_DEBUG,
                   "FTP: not resuming %s%s, the copy is not dated as the remote",
-                  back->url_adr, back->url_fil);
+                  adr_nologin(opt, back->url_adr), back->url_fil);
     return HTS_FALSE;
   }
   return HTS_TRUE;
@@ -881,7 +881,8 @@ int run_launch_ftp(FTPDownloadStruct * pStruct) {
     SOCaddr_initport(server, port);
 
     strcpybuff(back->info, "connect");
-    hts_log_print(opt, LOG_DEBUG, "FTP: connecting to %s:%d", _adr, port);
+    hts_log_print(opt, LOG_DEBUG, "FTP: connecting to %s:%d",
+                  adr_nologin(opt, _adr), port);
 
     if (!ftp_connect(back, soc_ctl, &server, timeout, opt)) {
       strcpybuff(back->r.msg, "Unable to connect to the server");
@@ -1414,7 +1415,12 @@ int send_line(T_SOC soc, const char *data) {
 
   if (_DEBUG_HEAD) {
     if (ioinfo) {
-      fprintf(ioinfo, "---> %s\x0d\x0a", data);
+      if (strncmp(data, "PASS ", 5) == 0) {
+        fprintf(ioinfo, "---> PASS ");
+        fprint_redacted(ioinfo, strlen(data + 5));
+        fprintf(ioinfo, "\x0d\x0a");
+      } else
+        fprintf(ioinfo, "---> %s\x0d\x0a", data);
       fflush(ioinfo);
     }
   }
diff --git a/src/htslib.c b/src/htslib.c
index 235ec5720..29184bd29 100644
--- a/src/htslib.c
+++ b/src/htslib.c
@@ -1702,6 +1702,8 @@ int http_sendhead(httrackp *opt, t_cookie *cookie, int mode, const char *xsend,
         strcpybuff(user_pass, unescape_http(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), user_pass));
         code64((unsigned char *) user_pass, (int) strlen(user_pass),
                (unsigned char *) autorisation, 0);
+        hts_secret_add(opt, autorisation, strlen(autorisation),
+                       HTS_SECRET_HEADER);
         print_buffer(&bstr, "Proxy-Authorization: Basic %s"H_CRLF,
                      autorisation);
 #if HDEBUG
@@ -1959,6 +1961,8 @@ int http_sendhead(httrackp *opt, t_cookie *cookie, int mode, const char *xsend,
                                        OPT_GET_BUFF_SIZE(opt), user_pass));
               code64((unsigned char *) user_pass, (int) strlen(user_pass),
                      (unsigned char *) autorisation, 0);
+              hts_secret_add(opt, autorisation, strlen(autorisation),
+                             HTS_SECRET_HEADER);
               if (strcmp(fil, "/robots.txt")) /* pas robots.txt */
                 bauth_add(cookie, astart, fil, autorisation);
             } else {
@@ -2021,9 +2025,9 @@ int http_sendhead(httrackp *opt, t_cookie *cookie, int mode, const char *xsend,
 #endif
   if (_DEBUG_HEAD) {
     if (ioinfo) {
-      fprintf(ioinfo, "[%d] request for %s%s:\r\n", retour->debugid,
-              jump_identification_const(adr), fil);
-      fprintfio(ioinfo, bstr.buffer, "<<< ");
+      hts_secret_fprintf(opt, ioinfo, "[%d] request for %s%s:\r\n",
+                         retour->debugid, jump_identification_const(adr), fil);
+      fprintfio(ioinfo, bstr.buffer, "<<< ", opt);
       fprintf(ioinfo, "\r\n");
       fflush(ioinfo);
     }
@@ -2567,7 +2571,7 @@ void treathead_opt(httrackp *opt, t_cookie *cookie, const char *adr,
                                 &attr) != 0) {
             hts_log_print(opt, LOG_WARNING,
                           "Cookies: the jar did not store '%.64s' set by %s",
-                          cook_name, adr);
+                          cook_name, adr_nologin(opt, adr));
           }
         }
       }
@@ -4351,8 +4355,86 @@ char *FUN(char *source) { \
   return ret != NULL ? source + ( ret - source ) : NULL; \
 }
 
-// retourne le pointeur ou le pointeur + offset si il existe dans la chaine un @ signifiant 
-// une identification
+/* Appends n bytes of s at buf[*len], clipped to size - 1, NUL-terminated. */
+static void append_clipped(char *buf, size_t size, size_t *len, const char *s,
+                           size_t n) {
+  if (n > size - 1 - *len)
+    n = size - 1 - *len;
+  memcpy(buf + *len, s, n);
+  *len += n;
+  buf[*len] = '\0';
+}
+
+/* Returns adr past its blanks, scheme and "//", the engine's or any
+   "scheme://", or adr when it has no scheme. */
+static const char *login_start(const char *adr) {
+  const char *s = adr;
+  const char *known;
+
+  while (isspace((unsigned char) *s))
+    s++;
+  known = jump_protocol_const(s);
+  if (known != s)
+    return known;
+  if (!isalpha((unsigned char) *s))
+    return adr;
+  while (isalnum((unsigned char) *s) || *s == '+' || *s == '-' || *s == '.')
+    s++;
+  return strncmp(s, "://", 3) == 0 ? s + 3 : adr;
+}
+
+/* Returns adr past its login, or login_start(adr) when it has none. */
+static const char *login_end(const char *adr) {
+  const char *const start = login_start(adr);
+  const char *const at = strrchr_limit(start, '@', strchr(start, '/'));
+
+  return at != NULL ? at : start;
+}
+
+/* Returns HTS_TRUE when adr has a login, a user alone included. */
+static hts_boolean has_login(const char *adr) {
+  return login_end(adr) > login_start(adr) ? HTS_TRUE : HTS_FALSE;
+}
+
+const char *adr_nologin_r(char *buf, size_t size, const char *adr) {
+  const char *const scheme = login_start(adr);
+  const char *const host = login_end(adr);
+  const char *colon;
+  size_t len = 0;
+
+  if (!has_login(adr) || size == 0)
+    return adr;
+  colon = memchr(scheme, ':', (size_t) (host - scheme));
+  buf[0] = '\0';
+  if (colon != NULL) {
+    append_clipped(buf, size, &len, adr, (size_t) (colon - adr));
+    append_clipped(buf, size, &len, ":***@", 5);
+  } else {
+    append_clipped(buf, size, &len, adr, (size_t) (scheme - adr));
+    append_clipped(buf, size, &len, "***@", 4);
+  }
+  append_clipped(buf, size, &len, host, strlen(host));
+  return buf;
+}
+
+const char *url_nologin_r(char *buf, size_t size, const char *url) {
+  return login_start(url) != url ? adr_nologin_r(buf, size, url) : url;
+}
+
+const char *adr_nologin(httrackp *opt, const char *adr) {
+  if (!has_login(adr))
+    return adr;
+  // no buffer to mask into: drop the whole login
+  if (opt == NULL)
+    return login_end(adr);
+  return adr_nologin_r(OPT_GET_BUFF(opt), OPT_GET_BUFF_SIZE(opt), adr);
+}
+
+const char *url_nologin(httrackp *opt, const char *url) {
+  return login_start(url) != url ? adr_nologin(opt, url) : url;
+}
+
+// Returns source past its login (user:pass@), if any.
 HTSEXT_API const char *jump_identification_const(const char *source) {
   const char *a, *trytofind;
 
@@ -5806,25 +5888,526 @@ int may_unknown2(httrackp * opt, const char *mime, const char *filename) {
 
 // -- Utils fichiers
 
-// pretty print for i/o
-void fprintfio(FILE * fp, const char *buff, const char *prefix) {
-  char nl = 1;
+/* The backstop: the passwords and tokens the engine has seen, hidden by value
+   in every log line, behind the per-site masking. */
+typedef struct hts_secret_set {
+  htsmutex lock;
+  int count;
+  hts_boolean full;    /* a secret was refused for want of room */
+  hts_boolean toolong; /* a secret was refused for its length */
+  char *item[HTS_SECRET_MAX];
+  size_t len[HTS_SECRET_MAX];
+  hts_secret_kind kind[HTS_SECRET_MAX];
+} hts_secret_set;
 
-  while(*buff) {
-    switch (*buff) {
-    case 13:
-      break;
-    case 10:
-      fprintf(fp, "\r\n");
-      nl = 1;
+void hts_secret_init(httrackp *opt) {
+  hts_secret_set *const set = calloct(1, sizeof(hts_secret_set));
+
+  if (set != NULL)
+    hts_mutexinit(&set->lock);
+  opt->secrets = set;
+}
+
+void hts_secret_free(httrackp *opt) {
+  hts_secret_set *set = (hts_secret_set *) opt->secrets;
+  int i;
+
+  if (set == NULL)
+    return;
+  for (i = 0; i < set->count; i++)
+    freet(set->item[i]);
+  hts_mutexfree(&set->lock);
+  freet(set);
+  opt->secrets = NULL;
+}
+
+void hts_secret_add(httrackp *opt, const char *s, size_t len,
+                    hts_secret_kind kind) {
+  hts_secret_set *const set =
+      opt != NULL ? (hts_secret_set *) opt->secrets : NULL;
+  hts_boolean warn = HTS_FALSE, warnlong = HTS_FALSE;
+  int i;
+
+  if (set == NULL || len == 0 ||
+      (kind == HTS_SECRET_HEADER && len < HTS_SECRET_TOKEN))
+    return;
+  hts_mutexlock(&set->lock);
+  for (i = 0; i < set->count; i++)
+    if (set->kind[i] == kind && set->len[i] == len &&
+        memcmp(set->item[i], s, len) == 0)
       break;
-    default:
+  if (len > HTS_SECRET_MAXLEN) {
+    warnlong = set->toolong ? HTS_FALSE : HTS_TRUE;
+    set->toolong = HTS_TRUE;
+  } else if (i == set->count) {
+    if (set->count < HTS_SECRET_MAX) {
+      char *const copy = malloct(len + 1);
+
+      if (copy != NULL) {
+        memcpy(copy, s, len);
+        copy[len] = '\0';
+        set->item[set->count] = copy;
+        set->len[set->count] = len;
+        set->kind[set->count] = kind;
+        set->count++;
+      }
+    } else if (!set->full) {
+      set->full = HTS_TRUE;
+      warn = HTS_TRUE;
+    }
+  }
+  hts_mutexrelease(&set->lock);
+  // the log line takes the lock again
+  if (warn)
+    hts_log_print(opt, LOG_WARNING,
+                  "more than %d passwords seen: the log hides the later ones"
+                  " only where they stand in a URL",
+                  HTS_SECRET_MAX);
+  if (warnlong)
+    hts_log_print(opt, LOG_WARNING,
+                  "a password or token is over %d bytes, so the log hides it"
+                  " only in a URL login or a known header",
+                  HTS_SECRET_MAXLEN);
+}
+
+void hts_secret_add_login(httrackp *opt, const char *url) {
+  const char *start, *host, *colon;
+
+  if (url == NULL)
+    return;
+  start = login_start(url);
+  host = login_end(url);
+  if (host <= start)
+    return;
+  colon = memchr(start, ':', (size_t) (host - 1 - start));
+  if (colon == NULL)
+    return;
+  hts_secret_add(opt, colon + 1, (size_t) (host - 1 - (colon + 1)),
+                 HTS_SECRET_LOGIN);
+  // the Basic login is sent unescaped
+  if (memchr(colon + 1, '%', (size_t) (host - 1 - (colon + 1))) != NULL &&
+      (size_t) (host - 1 - (colon + 1)) < HTS_SECRET_MAXLEN) {
+    char pass[HTS_SECRET_MAXLEN + 1];
+    char plain[HTS_SECRET_MAXLEN + 1];
+    const char *p;
+
+    pass[0] = '\0';
+    strncatbuff(pass, colon + 1, (size_t) (host - 1 - (colon + 1)));
+    p = unescape_http(plain, sizeof(plain), pass);
+    hts_secret_add(opt, p, strlen(p), HTS_SECRET_LOGIN);
+  }
+}
+
+/* Does a word start at s + i, after the line start, a blank, a quote, '(' or
+   '<', or right after "://"? */
+static hts_boolean word_start(const char *s, size_t i) {
+  return i == 0 || strchr(" \t\r\n\"'(<", s[i - 1]) != NULL ||
+                 (i >= 3 && strncmp(s + i - 3, "://", 3) == 0)
+             ? HTS_TRUE
+             : HTS_FALSE;
+}
+
+/* Does the n bytes at s + i stand as a login, as in "SECRET@" or
+   "user:SECRET@", whose userinfo starts a word? */
+static hts_boolean login_at(const char *s, size_t len, size_t i, size_t n) {
+  // schemes whose "name:local@host" is an address, not a login
+  static const char *const opaque[] = {"mailto", "news", "sip",
+                                       "sips",   "tel",  "xmpp"};
+  size_t u = i, k;
+
+  if (i + n >= len || s[i + n] != '@')
+    return HTS_FALSE;
+  if (i != 0 && s[i - 1] == ':') {
+    u = i - 1;
+    while (u != 0 && strchr("/ \t\r\n", s[u - 1]) == NULL)
+      u--;
+    for (k = 0; k < sizeof(opaque) / sizeof(opaque[0]); k++)
+      if (strlen(opaque[k]) == i - 1 - u && strfield(s + u, opaque[k]))
+        return HTS_FALSE;
+  }
+  return word_start(s, u);
+}
+
+/* Returns the length of the longest secret of set standing at s + i, or 0. A
+   URL password counts only as a login, a header token anywhere. */
+static size_t secret_at(const hts_secret_set *set, const char *s, size_t len,
+                        size_t i) {
+  size_t best = 0;
+  int k;
+
+  for (k = 0; k < set->count; k++) {
+    const size_t n = set->len[k];
+
+    if (n <= best || n > len - i || memcmp(s + i, set->item[k], n) != 0)
+      continue;
+    if (set->kind[k] == HTS_SECRET_HEADER || login_at(s, len, i, n))
+      best = n;
+  }
+  return best;
+}
+
+/* Copies the len bytes at s to out, if not NULL, with each secret of set
+   replaced. Returns the length written. */
+static size_t secret_scan(const hts_secret_set *set, const char *s, size_t len,
+                          char *out) {
+  size_t i = 0, o = 0;
+
+  while (i < len) {
+    const size_t n = secret_at(set, s, len, i);
+
+    if (n != 0) {
+      if (out != NULL)
+        memcpy(out + o, "***", 3);
+      o += 3;
+      i += n;
+    } else {
+      if (out != NULL)
+        out[o] = s[i];
+      o++;
+      i++;
+    }
+  }
+  return o;
+}
+
+/* Returns a copy of the len bytes at s with each secret of opt as ***,
+   allocated with malloct, its length in *outlen. NULL when no secret is
+   known, or *outlen set to 0 too when out of memory. */
+static char *secret_mask(httrackp *opt, const char *s, size_t len,
+                         size_t *outlen) {
+  hts_secret_set *const set =
+      opt != NULL ? (hts_secret_set *) opt->secrets : NULL;
+  char *out = NULL;
+
+  *outlen = 1;
+  if (set == NULL)
+    return NULL;
+  hts_mutexlock(&set->lock);
+  if (set->count != 0) {
+    *outlen = secret_scan(set, s, len, NULL);
+    out = malloct(*outlen + 1);
+    if (out != NULL) {
+      secret_scan(set, s, len, out);
+      out[*outlen] = '\0';
+    } else
+      *outlen = 0;
+  }
+  hts_mutexrelease(&set->lock);
+  return out;
+}
+
+void hts_secret_fwrite(httrackp *opt, FILE *fp, const char *s, size_t len) {
+  size_t n;
+  char *masked = secret_mask(opt, s, len, &n);
+
+  if (masked != NULL)
+    fwrite(masked, 1, n, fp);
+  else if (n == 0)
+    fputs("<out of memory>", fp);
+  else
+    fwrite(s, 1, len, fp);
+  freet(masked);
+}
+
+/* Does opt know a secret? */
+static hts_boolean secrets_known(httrackp *opt) {
+  hts_secret_set *const set =
+      opt != NULL ? (hts_secret_set *) opt->secrets : NULL;
+  hts_boolean known;
+
+  if (set == NULL)
+    return HTS_FALSE;
+  hts_mutexlock(&set->lock);
+  known = set->count != 0 ? HTS_TRUE : HTS_FALSE;
+  hts_mutexrelease(&set->lock);
+  return known;
+}
+
+/* vfprintf() to fp, with each secret of opt as ***. */
+static void secret_vfprintf(httrackp *opt, FILE *fp, const char *format,
+                            va_list args) {
+  va_list args_copy;
+  int n;
+  char *line;
+
+  if (!secrets_known(opt)) {
+    (void) vfprintf(fp, format, args);
+    return;
+  }
+  va_copy(args_copy, args);
+  n = vsnprintf(NULL, 0, format, args_copy);
+  va_end(args_copy);
+  if (n < 0)
+    return;
+  line = malloct((size_t) n + 1);
+  if (line == NULL) {
+    fputs("<out of memory>", fp);
+    return;
+  }
+  (void) vsnprintf(line, (size_t) n + 1, format, args);
+  hts_secret_fwrite(opt, fp, line, (size_t) n);
+  freet(line);
+}
+
+void hts_secret_fprintf(httrackp *opt, FILE *fp, const char *format, ...) {
+  va_list args;
+
+  va_start(args, format);
+  secret_vfprintf(opt, fp, format, args);
+  va_end(args);
+}
+
+HTSEXT_API void hts_hide_secrets(httrackp *opt, char *s, size_t size) {
+  size_t n;
+  char *masked;
+
+  if (size == 0)
+    return;
+  masked = secret_mask(opt, s, strlen(s), &n);
+  if (masked != NULL) {
+    s[0] = '\0';
+    strlncatbuff(s, masked, size, size - 1);
+  } else if (n == 0)
+    s[0] = '\0';
+  freet(masked);
+}
+
+void fprint_redacted(FILE *fp, size_t len) {
+  fprintf(fp, "<redacted, %lu bytes>", (unsigned long) len);
+}
+
+/* The -%H log hides the value of these fields because they carry logins.
+   Unlike refused[] and single[], this list governs the log, not the wire. */
+static const char *const secret_fields[] = {
+    "Authorization", "Proxy-Authorization", "Cookie", "Set-Cookie"};
+
+/* The -%H log hides the login of the URL these fields carry. */
+static const char *const url_fields[] = {"Location", "Content-Location",
+                                         "Referer"};
+
+/* Writes the line buff, len bytes long, with the login of its URL, from keep
+   up to end, masked. Returns HTS_FALSE, writing nothing, when out of memory. */
+static hts_boolean fprint_url_span(httrackp *opt, FILE *fp, const char *buff,
+                                   size_t len, size_t keep, size_t end) {
+  char *line = malloct(2 * end + 8);
+
+  if (line == NULL)
+    return HTS_FALSE;
+  memcpy(line, buff, end);
+  line[end] = '\0';
+  {
+    const char *const url = url_nologin_r(line + end + 1, end + 7, line + keep);
+
+    hts_secret_fwrite(opt, fp, line, keep);
+    hts_secret_fwrite(opt, fp, url, strlen(url));
+    hts_secret_fwrite(opt, fp, buff + end, len - end);
+  }
+  freet(line);
+  return HTS_TRUE;
+}
+
+/* Writes the header line buff, len bytes long, with the login of its URL
+   value masked. Returns HTS_FALSE, writing nothing, when out of memory. */
+static hts_boolean fprint_url_field(httrackp *opt, FILE *fp, const char *buff,
+                                    size_t len) {
+  const char *const colon = memchr(buff, ':', len);
+  size_t keep = colon != NULL ? (size_t) (colon - buff) + 1 : len;
+
+  while (keep < len && (buff[keep] == ' ' || buff[keep] == '\t'))
+    keep++;
+  return fprint_url_span(opt, fp, buff, len, keep, len);
+}
+
+/* Writes the request line buff, len bytes long, with the login of its target
+   masked, as a proxied ftp:// target carries one. Returns HTS_FALSE, writing
+   nothing, when buff is no "METHOD target HTTP/" line or out of memory. */
+static hts_boolean fprint_request_line(httrackp *opt, FILE *fp,
+                                       const char *buff, size_t len) {
+  const char *const sp = memchr(buff, ' ', len);
+  const char *version;
+
+  if (sp == NULL)
+    return HTS_FALSE;
+  version = memchr(sp + 1, ' ', len - (size_t) (sp + 1 - buff));
+  if (version == NULL || (size_t) (buff + len - version) < 6 ||
+      strncmp(version, " HTTP/", 6) != 0)
+    return HTS_FALSE;
+  return fprint_url_span(opt, fp, buff, len, (size_t) (sp + 1 - buff),
+                         (size_t) (version - buff));
+}
+
+/* Finds the secret of the userinfo at the authority a, which ends at the last
+   '@' before the first '/', the split jump_identification_const() makes: the
+   password after the first ':', or a user alone. A token also ends at a
+   blank. Returns HTS_FALSE when there is no userinfo. */
+static hts_boolean userinfo_password(const char *a, hts_boolean token,
+                                     const char **pass, const char **at) {
+  const char *end = a + strcspn(a, token ? "/ \t\r\n" : "/");
+  const char *colon;
+
+  while (end > a && end[-1] != '@')
+    end--;
+  if (end == a)
+    return HTS_FALSE;
+  colon = memchr(a, ':', (size_t) (end - 1 - a));
+  *pass = colon != NULL ? colon + 1 : a;
+  *at = end - 1;
+  return HTS_TRUE;
+}
+
+/* The masked copy: dst (NULL to only count) holds o bytes, and the source is
+   copied up to p. */
+typedef struct {
+  char *dst;
+  size_t o;
+  const char *p;
+} mask_out;
+
+static void mask_copy(mask_out *m, const char *src, size_t n) {
+  if (m->dst != NULL)
+    memcpy(m->dst + m->o, src, n);
+  m->o += n;
+}
+
+/* Masks the login secret of the address at a, if any, and moves *i past it. */
+static void mask_at(mask_out *m, const char *a, hts_boolean token,
+                    const char **i) {
+  const char *pass, *at;
+
+  if (!userinfo_password(jump_protocol_const(a), token, &pass, &at))
+    return;
+  mask_copy(m, m->p, (size_t) (pass - m->p));
+  mask_copy(m, "***", 3);
+  m->p = *i = at;
+}
+
+/* Copies s to dst, or only counts when dst is NULL, with the login secret of
+   each address written as ***. Returns the length. */
+static size_t mask_passwords(const char *s, char *dst, hts_mask_mode mode) {
+  mask_out m = {dst, 0, s};
+  const char *i = s;
+
+  if (mode == HTS_MASK_ADDR)
+    mask_at(&m, s, HTS_FALSE, &i);
+  else
+    for (; *i != '\0'; i++)
+      // a token that is no filter is a start URL
+      if ((i == s || strchr(" \t\r\n", i[-1]) != NULL) &&
+          strchr(" \t\r\n+-", *i) == NULL)
+        mask_at(&m, i, HTS_TRUE, &i);
+  mask_copy(&m, m.p, strlen(m.p) + 1);
+  return m.o - 1;
+}
+
+char *hts_mask_passwords(const char *s, hts_mask_mode mode) {
+  const size_t len = mask_passwords(s, NULL, mode);
+  char *const dst = (char *) malloct(len + 1);
+
+  if (dst != NULL)
+    mask_passwords(s, dst, mode);
+  return dst;
+}
+
+/* Returns the length of the secret field name opening line, a line len bytes
+   long, even with no colon behind it, or 0. */
+static size_t secret_name_len(const char *line, size_t len) {
+  size_t word, i;
+
+  if (header_name_in(line, secret_fields,
+                     sizeof(secret_fields) / sizeof(secret_fields[0])))
+    return header_name_len(line);
+  if (memchr(line, ':', len) != NULL)
+    return 0;
+  word = strcspn(line, " \t\r\n");
+  for (i = 0; i < sizeof(secret_fields) / sizeof(secret_fields[0]); i++)
+    if (header_name_is(line, word, secret_fields[i], strlen(secret_fields[i])))
+      return word;
+  return 0;
+}
+
+void hts_secret_add_headers(httrackp *opt, const char *headers) {
+  const char *line = headers;
+
+  while (line != NULL && *line != '\0') {
+    const size_t len = strcspn(line, "\r\n");
+    const size_t name = len != 0 ? secret_name_len(line, len) : 0;
+
+    if (name != 0) {
+      const char *const colon = memchr(line, ':', len);
+      const char *v = colon != NULL ? colon + 1 : line + name;
+      const char *end = line + len;
+
+      while (v < end && (*v == ' ' || *v == '\t'))
+        v++;
+      while (end > v && (end[-1] == ' ' || end[-1] == '\t'))
+        end--;
+      // a cookie value is often a plain word, and -%H hides the whole header
+      if (!header_name_is(line, name, "Cookie", 6) &&
+          !header_name_is(line, name, "Set-Cookie", 10)) {
+        // the whole value, then the credentials after the scheme ("Basic
+        // TOKEN")
+        const char *cred = v + strcspn(v, " \t");
+
+        hts_secret_add(opt, v, (size_t) (end - v), HTS_SECRET_HEADER);
+        while (cred < end && (*cred == ' ' || *cred == '\t'))
+          cred++;
+        if (cred < end)
+          hts_secret_add(opt, cred, (size_t) (end - cred), HTS_SECRET_HEADER);
+      }
+    }
+    line += len;
+    while (*line == '\r' || *line == '\n')
+      line++;
+  }
+}
+
+void fprintfio(FILE *fp, const char *buff, const char *prefix, httrackp *opt) {
+  const char *const start = buff;
+  hts_boolean nl = HTS_TRUE;
+  hts_boolean secret = HTS_FALSE;
+  size_t name = 0;
+
+  while (*buff != '\0') {
+    const size_t len = strcspn(buff, "\r\n");
+
+    if (len != 0) {
+      size_t keep = len;
+
+      /* a folded line continues the value above it */
+      if (*buff != ' ' && *buff != '\t') {
+        name = secret_name_len(buff, len);
+        secret = name != 0 ? HTS_TRUE : HTS_FALSE;
+      }
+      if (secret) {
+        const char *const colon = memchr(buff, ':', len);
+
+        /* a line with no colon is redacted after its name */
+        keep = *buff == ' ' || *buff == '\t' ? 0
+               : colon != NULL               ? (size_t) (colon - buff) + 1
+                                             : name;
+        while (keep < len && (buff[keep] == ' ' || buff[keep] == '\t'))
+          keep++;
+      }
       if (nl)
         fprintf(fp, "%s", prefix);
-      nl = 0;
-      fputc(*buff, fp);
+      nl = HTS_FALSE;
+      if (!(buff == start && fprint_request_line(opt, fp, buff, len)) &&
+          (secret || *buff == ' ' || *buff == '\t' ||
+           !header_name_in(buff, url_fields,
+                           sizeof(url_fields) / sizeof(url_fields[0])) ||
+           !fprint_url_field(opt, fp, buff, len))) {
+        hts_secret_fwrite(opt, fp, buff, keep);
+        if (keep < len)
+          fprint_redacted(fp, len - keep);
+      }
+    }
+    buff += len;
+    if (*buff == '\n') {
+      fprintf(fp, "\r\n");
+      nl = HTS_TRUE;
     }
-    buff++;
+    if (*buff != '\0')
+      buff++;
   }
 }
 
@@ -7264,7 +7847,7 @@ HTSEXT_API void hts_log_vprint(httrackp * opt, int type, const char *format, va_
 
     if (opt->log != NULL) {
       fspc(opt, opt->log, s_type);
-      (void) vfprintf(opt->log, format, args);
+      secret_vfprintf(opt, opt->log, format, args);
       if ((type & LOG_ERRNO) != 0) {
         char errbuf[HTS_STRERROR_SIZE];
 
@@ -7399,6 +7982,7 @@ HTSEXT_API httrackp *hts_create_opt(void) {
 
   /* mutexes */
   hts_mutexinit(&opt->state.lock);
+  hts_secret_init(opt);
 
   /* custom wrappers */
   opt->libHandles.count = 0;
@@ -7675,6 +8259,7 @@ HTSEXT_API void hts_free_opt(httrackp * opt) {
     StringFree(opt->path_bin);
 
     /* mutexes */
+    hts_secret_free(opt);
     hts_mutexfree(&opt->state.lock);
 
     /* Free structure */
diff --git a/src/htslib.h b/src/htslib.h
index 20755dca5..9cb75bc2e 100644
--- a/src/htslib.h
+++ b/src/htslib.h
@@ -541,7 +541,80 @@ char *convtolower(char *catbuff, size_t catbuffsize, const char *a);
 void hts_lowcase(char *s);
 int multipleStringMatch(const char *s, const char *match);
 
-void fprintfio(FILE * fp, const char *buff, const char *prefix);
+/* Writes a header block to fp, each line after prefix, with the value of a
+   field that carries a login replaced by the fprint_redacted() marker, and
+   each secret opt knows as ***. opt may be NULL. */
+void fprintfio(FILE *fp, const char *buff, const char *prefix, httrackp *opt);
+
+/* The backstop behind the per-site masking: opt keeps the first
+   HTS_SECRET_MAX passwords and tokens it sees, each up to HTS_SECRET_MAXLEN
+   bytes, and the log writers print each as ***. A URL password is hidden only
+   as a login, before an '@', so a password such as "index" leaves index.html
+   alone. A header token of HTS_SECRET_TOKEN bytes or more is hidden anywhere.
+ */
+#define HTS_SECRET_MAX 64
+#define HTS_SECRET_MAXLEN 1024
+#define HTS_SECRET_TOKEN 8
+
+typedef enum hts_secret_kind {
+  HTS_SECRET_LOGIN, /* a URL password */
+  HTS_SECRET_HEADER /* a header token, kept only from HTS_SECRET_TOKEN bytes */
+} hts_secret_kind;
+
+/* Allocates and frees the set of opt->secrets. */
+void hts_secret_init(httrackp *opt);
+void hts_secret_free(httrackp *opt);
+
+/* Adds the len bytes at s to the set of opt. Thread-safe. Once the set is
+   full, or for a secret over HTS_SECRET_MAXLEN bytes, logs one warning and
+   adds nothing. */
+void hts_secret_add(httrackp *opt, const char *s, size_t len,
+                    hts_secret_kind kind);
+
+/* Adds the password of the login of url, in any scheme or none, raw and
+   unescaped. A user alone is not added. url may be NULL. */
+void hts_secret_add_login(httrackp *opt, const char *url);
+
+/* Adds the values of the Authorization, Proxy-Authorization and Cookie lines
+   of a -%X header block, which may be NULL. */
+void hts_secret_add_headers(httrackp *opt, const char *headers);
+
+/* Writes the len bytes at s to fp, with each secret of opt as ***. */
+void hts_secret_fwrite(httrackp *opt, FILE *fp, const char *s, size_t len);
+
+/* fprintf() to fp, with each secret of opt as ***. */
+void hts_secret_fprintf(httrackp *opt, FILE *fp, const char *format, ...)
+    HTS_PRINTF_FUN(3, 4);
+
+/* What hts_mask_passwords() reads: */
+typedef enum {
+  HTS_MASK_LIST, /* blank-separated start URLs and filters */
+  HTS_MASK_ADDR  /* one start URL, or a -P value */
+} hts_mask_mode;
+
+/* Returns a copy of s, allocated with malloct, in which the password, or the
+   user alone, of every start URL or proxy address in s is *** . The rest stays
+   byte for byte. NULL when out of memory. */
+char *hts_mask_passwords(const char *s, hts_mask_mode mode);
+
+/* Log calls never print an address raw: pass adr_nologin() or url_nologin(),
+   which test 660 checks. */
+
+/* Returns adr with its login masked as user:*** or ***, for log lines: adr
+   itself when it has no login, else a copy clipped to size bytes in buf. */
+const char *adr_nologin_r(char *buf, size_t size, const char *adr);
+
+/* Same as adr_nologin_r(), but only a URL with a scheme or "//" has a login.
+   Any "scheme://" counts, not only the ones the engine fetches. */
+const char *url_nologin_r(char *buf, size_t size, const char *url);
+
+/* adr_nologin_r() and url_nologin_r() into a rotating buffer of opt, which
+   they take only when there is a login. A NULL opt drops the login. */
+const char *adr_nologin(httrackp *opt, const char *adr);
+const char *url_nologin(httrackp *opt, const char *url);
+
+/* Writes the marker that stands for a hidden secret of len bytes. */
+void fprint_redacted(FILE *fp, size_t len);
 
 /* A write to a socket whose peer is gone raises SIGPIPE, and the default
    action kills the process. The library must not install a handler, because
diff --git a/src/htslib_selftest.c b/src/htslib_selftest.c
index 3b2d378bf..0f36d47f7 100644
--- a/src/htslib_selftest.c
+++ b/src/htslib_selftest.c
@@ -1599,6 +1599,325 @@ static int st_gmtime(httrackp *opt, int argc, char **argv) {
   return err;
 }
 
+/* Is the masked in exactly want? Prints the difference when it is not. */
+static int maskpw_row(const char *in, const char *want, hts_mask_mode mode) {
+  char *got = hts_mask_passwords(in, mode);
+  const int err = got == NULL || strcmp(got, want) != 0;
+
+  if (err)
+    fprintf(stderr, "maskpw: '%.80s' gave '%.80s', want '%.80s'\n", in,
+            got != NULL ? got : "(null)", want);
+  freet(got);
+  return err;
+}
+
+/* A hostile URL of n ":@" pairs: in a path it stays, in a userinfo it is one
+   password. */
+static int maskpw_pairs(size_t n) {
+  const size_t len = 2 * n;
+  char *pairs = (char *) malloct(len + 1);
+  char *in = (char *) malloct(len + 32);
+  int err;
+
+  if (pairs == NULL || in == NULL) {
+    freet(pairs);
+    freet(in);
+    return 1;
+  }
+  memset(pairs, ':', len);
+  for (size_t i = 1; i < len; i += 2)
+    pairs[i] = '@';
+  pairs[len] = '\0';
+  snprintf(in, len + 32, "http://h/x?%s", pairs);
+  err = maskpw_row(in, in, HTS_MASK_LIST);
+  snprintf(in, len + 32, "a%sh/ -x", pairs);
+  err |= maskpw_row(in, "a:***@h/ -x", HTS_MASK_LIST);
+  snprintf(in, len + 32, "http://a%sh", pairs);
+  err |= maskpw_row(in, "http://a:***@h", HTS_MASK_ADDR);
+  freet(pairs);
+  freet(in);
+  return err;
+}
+
+/* Do the nologin helpers hide the password and nothing else? */
+static int nologin_rows(httrackp *opt) {
+  static const struct {
+    const char *in, *want;
+  } adrs[] = {{"u:p@h:80", "u:***@h:80"}, {"u:p@q@h", "u:***@h"},
+              {"u@h", "***@h"},           {":p@h", ":***@h"},
+              {"h:80", "h:80"},           {"file://", "file://"},
+              {"https://h", "https://h"}, {"https://u:p@h", "https://u:***@h"}},
+    urls[] = {{"http://u:p@h/x", "http://u:***@h/x"},
+              {"//u:p@q@h", "//u:***@h"},
+              {"http://tok@h/x", "http://***@h/x"},
+              {"HTTPS://u:a b@[::1]:8/", "HTTPS://u:***@[::1]:8/"},
+              {"http://h/x?a@b", "http://h/x?a@b"},
+              {"mailto:a@b", "mailto:a@b"},
+              {"u:p@h/x", "u:p@h/x"},
+              {"http://u:p@hostname.example/x", "http://u:***@hostname.e"}};
+  char buf[24];
+  const int index = opt->state.concat.index;
+  int err = 0;
+  size_t i;
+
+  for (i = 0; i < sizeof(adrs) / sizeof(adrs[0]); i++) {
+    const char *got = adr_nologin_r(buf, sizeof(buf), adrs[i].in);
+
+    if (strcmp(got, adrs[i].want) != 0) {
+      fprintf(stderr, "adr_nologin: '%s' gave '%s'\n", adrs[i].in, got);
+      err = 1;
+    }
+  }
+  for (i = 0; i < sizeof(urls) / sizeof(urls[0]); i++) {
+    const char *got = url_nologin_r(buf, sizeof(buf), urls[i].in);
+
+    if (strcmp(got, urls[i].want) != 0) {
+      fprintf(stderr, "url_nologin: '%s' gave '%s'\n", urls[i].in, got);
+      err = 1;
+    }
+  }
+  /* An address without a login is returned as is, and takes no buffer. */
+  if (adr_nologin(opt, adrs[4].in) != adrs[4].in ||
+      url_nologin(opt, urls[6].in) != urls[6].in ||
+      opt->state.concat.index != index) {
+    fprintf(stderr, "nologin: a rotating buffer was taken without a login\n");
+    err = 1;
+  }
+  /* Without an opt, as back_delete(NULL, ...) logs, the login is dropped. */
+  if (strcmp(adr_nologin(NULL, urls[0].in), "h/x") != 0 ||
+      strcmp(url_nologin(NULL, urls[0].in), "h/x") != 0) {
+    fprintf(stderr, "nologin: a NULL opt kept the login\n");
+    err = 1;
+  }
+  return err;
+}
+
+/* Reads back the log of o, from offset at, into buf. */
+static void secrets_read(FILE *fp, long at, char *buf, size_t size) {
+  size_t n;
+
+  fflush(fp);
+  fseek(fp, at, SEEK_SET);
+  n = fread(buf, 1, size - 1, fp);
+  buf[n] = '\0';
+  fseek(fp, 0, SEEK_END);
+}
+
+/* Logs line through o and checks the log holds want, and none of bad. */
+static int secrets_row(httrackp *o, FILE *fp, const char *line,
+                       const char *want, const char *bad) {
+  char got[4096];
+  const long at = ftell(fp);
+
+  hts_log_print(o, LOG_NOTICE, "%s", line);
+  secrets_read(fp, at, got, sizeof(got));
+  if (strstr(got, want) == NULL || (bad != NULL && strstr(got, bad) != NULL)) {
+    fprintf(stderr, "secrets: '%s' logged '%s', want '%s'\n", line, got, want);
+    return 1;
+  }
+  return 0;
+}
+
+/* A hostile page offers 200 passwords, each twice: the first
+   HTS_SECRET_MAX stay hidden, and one warning says so. */
+static int secrets_full(void) {
+  httrackp *const o = hts_create_opt();
+  FILE *const fp = tmpfile();
+  char got[4096];
+  const char *w;
+  int err = 0, i;
+
+  if (o == NULL || fp == NULL) {
+    fprintf(stderr, "secrets: out of memory\n");
+    return 1;
+  }
+  o->log = fp;
+  o->debug = LOG_DEBUG;
+  for (i = 0; i < 200; i++) {
+    char url[64];
+
+    snprintf(url, sizeof(url), "http://u:ZPWCAP%03d@h/", i);
+    hts_secret_add_login(o, url);
+    hts_secret_add_login(o, url);
+  }
+  hts_log_print(o, LOG_NOTICE, "u:ZPWCAP000@h u:ZPWCAP%03d@h u:ZPWCAP%03d@h",
+                HTS_SECRET_MAX - 1, HTS_SECRET_MAX);
+  secrets_read(fp, 0, got, sizeof(got));
+  w = strstr(got, "passwords seen");
+  if (strstr(got, "u:***@h u:***@h u:ZPWCAP064@h") == NULL || w == NULL ||
+      strstr(w + 1, "passwords seen") != NULL) {
+    fprintf(stderr, "secrets: full set logged '%s'\n", got);
+    err = 1;
+  }
+  o->log = NULL;
+  fclose(fp);
+  hts_free_opt(o);
+  return err;
+}
+
+static int st_secrets(httrackp *opt, int argc, char **argv) {
+  httrackp *const o = hts_create_opt();
+  FILE *const fp = tmpfile();
+  char got[4096];
+  char big[HTS_SECRET_MAXLEN + 16];
+  const char *w;
+  long at;
+  int err = 0;
+  (void) opt;
+  (void) argc;
+  (void) argv;
+
+  if (o == NULL || fp == NULL) {
+    fprintf(stderr, "secrets: out of memory\n");
+    return 1;
+  }
+  o->log = fp;
+  o->debug = LOG_DEBUG;
+  // none known: the line goes out as given
+  err |= secrets_row(o, fp, "a u:index@h/index.html", "a u:index@h/index.html",
+                     NULL);
+  // a password is hidden only as a login, at any length
+  hts_secret_add_login(o, "http://u:index@h/");
+  hts_secret_add_login(o, "http://u:download@h/");
+  err |= secrets_row(o, fp,
+                     "a u:index@h/index.html http://index.example/ index@h "
+                     "myindex@h /index (index@h <x:index@h \"index@h",
+                     "a u:***@h/index.html http://index.example/ ***@h "
+                     "myindex@h /index (***@h <x:***@h \"***@h",
+                     NULL);
+  err |= secrets_row(o, fp,
+                     "GET /download/file.html ftp://download@h u:download@h",
+                     "GET /download/file.html ftp://***@h u:***@h", NULL);
+  // an address is no login
+  err |= secrets_row(o, fp,
+                     "mailto:index@h MAILTO:index@h news:index@h "
+                     "a@index@h //x:index@h",
+                     "mailto:index@h MAILTO:index@h news:index@h "
+                     "a@index@h //x:index@h",
+                     NULL);
+  // a token is hidden anywhere, a short one not at all
+  hts_secret_add_headers(o, "X-Keep: ZPWKEEP12345\r\n"
+                            "Authorization: Bearer ZPWTOKEN123\r\n"
+                            "cookie: a=1; sid=ZPWSID9999\r\n"
+                            "Proxy-Authorization Basic ZPWNOCOLON1\r\n"
+                            "Authorization: Bearer ZPWSHRT");
+  err |= secrets_row(o, fp,
+                     "GET /x?t=ZPWTOKEN123&s=ZPWSID9999 a=1 ZPWKEEP12345 "
+                     "ZPWNOCOLON1 ZPWSHRT u:ZPWSHRT@h",
+                     "GET /x?t=***&s=ZPWSID9999 a=1 ZPWKEEP12345 *** ZPWSHRT "
+                     "u:ZPWSHRT@h",
+                     NULL);
+  // raw and unescaped, the way Basic sends it
+  hts_secret_add_login(o, "ftp://u:ZPW%40ESC99@h/");
+  err |= secrets_row(o, fp, "u:ZPW%40ESC99@h u:ZPW@ESC99@h ZPW%40ESC99",
+                     "u:***@h u:***@h ZPW%40ESC99", NULL);
+  // the user part of a login may hold an '@'
+  hts_secret_add_login(o, "http://john@example.com:ZPWATPW99@h/");
+  err |= secrets_row(o, fp, "http://john@example.com:ZPWATPW99@h/ ZPWATPW99",
+                     "http://john@example.com:***@h/ ZPWATPW99", NULL);
+  // a cookie value is no token: it is often an ordinary word
+  hts_secret_add_headers(o, "Cookie: consent=zpwaccepted\r\n");
+  err |=
+      secrets_row(o, fp, "/privacy/zpwaccepted-terms.html consent=zpwaccepted",
+                  "/privacy/zpwaccepted-terms.html consent=zpwaccepted", NULL);
+  // a user alone is no password
+  hts_secret_add_login(o, "http://ZPWUSERONLY@h/");
+  err |= secrets_row(o, fp, "ZPWUSERONLY@h", "ZPWUSERONLY@h", NULL);
+  // too long to keep: one warning
+  memset(big, 'Z', sizeof(big) - 1);
+  big[sizeof(big) - 1] = '\0';
+  at = ftell(fp);
+  hts_secret_add(o, big, HTS_SECRET_MAXLEN + 1, HTS_SECRET_HEADER);
+  hts_secret_add(o, big + 1, HTS_SECRET_MAXLEN + 1, HTS_SECRET_LOGIN);
+  secrets_read(fp, at, got, sizeof(got));
+  w = strstr(got, "over 1024 bytes");
+  if (w == NULL || strstr(w + 1, "over 1024 bytes") != NULL) {
+    fprintf(stderr, "secrets: a long secret logged '%s'\n", got);
+    err = 1;
+  }
+  err |= secrets_row(o, fp, big, big, "***");
+  // the -%H log and a front end's own buffer
+  at = ftell(fp);
+  fprintfio(fp, "GET /?k=ZPWTOKEN123 HTTP/1.1\r\nX-K: ZPWTOKEN123\r\n", "<<< ",
+            o);
+  secrets_read(fp, at, got, sizeof(got));
+  if (strcmp(got, "<<< GET /?k=*** HTTP/1.1\r\n<<< X-K: ***\r\n") != 0) {
+    fprintf(stderr, "secrets: fprintfio wrote '%s'\n", got);
+    err = 1;
+  }
+  strcpybuff(got, "h/x?t=ZPWTOKEN123");
+  hts_hide_secrets(o, got, sizeof(got));
+  if (strcmp(got, "h/x?t=***") != 0) {
+    fprintf(stderr, "secrets: hts_hide_secrets gave '%s'\n", got);
+    err = 1;
+  }
+  o->log = NULL;
+  fclose(fp);
+  hts_free_opt(o);
+  err |= secrets_full();
+  printf("secrets self-test: %s\n", err ? "FAIL" : "OK");
+  return err;
+}
+
+static int st_maskpw(httrackp *opt, int argc, char **argv) {
+  static const struct {
+    hts_mask_mode mode;
+    const char *in, *want;
+  } rows[] = {
+      {HTS_MASK_LIST, "", ""},
+      {HTS_MASK_LIST, "u:p@h http://v:q@g +*:*@* -*:*@*/x",
+       "u:***@h http://v:***@g +*:*@* -*:*@*/x"},
+      {HTS_MASK_LIST, "HTTP://u:p@h:80/x ftp://u:p@h",
+       "HTTP://u:***@h:80/x ftp://u:***@h"},
+      {HTS_MASK_LIST, "http://h1/ http://h/?r=ftp://u:p@g/",
+       "http://h1/ http://h/?r=ftp://u:p@g/"},
+      {HTS_MASK_LIST, "http://h/x?t=10:30@x", "http://h/x?t=10:30@x"},
+      {HTS_MASK_ADDR, "http://u:p@h/", "http://u:***@h/"},
+      {HTS_MASK_ADDR, "http://u@h/", "http://***@h/"},
+      {HTS_MASK_ADDR, "http://:p@h/", "http://:***@h/"},
+      {HTS_MASK_ADDR, "http://u:@h/", "http://u:***@h/"},
+      // the engine splits the userinfo at the last '@'
+      {HTS_MASK_ADDR, "http://u:p@SECRETB@h/", "http://u:***@h/"},
+      {HTS_MASK_ADDR, "http://user:pw;SECRETA@h/", "http://user:***@h/"},
+      {HTS_MASK_ADDR, "http://u:a,b=c\"d'e(f)<g> h@h/", "http://u:***@h/"},
+      {HTS_MASK_ADDR, "http://u:a%2Fb@h/", "http://u:***@h/"},
+      // a raw '/' ends the authority, so the engine sends no password
+      {HTS_MASK_ADDR, "http://u:a/b@h/", "http://u:a/b@h/"},
+      {HTS_MASK_ADDR, "u:p@h:8080", "u:***@h:8080"},
+      {HTS_MASK_ADDR, "u:p@q@h:8080", "u:***@h:8080"},
+      {HTS_MASK_ADDR, "u:a b@h/", "u:***@h/"},
+      {HTS_MASK_ADDR, "http://u:p@h:8080", "http://u:***@h:8080"},
+      {HTS_MASK_ADDR, "h:8080", "h:8080"},
+      {HTS_MASK_ADDR, "u@h:8080", "***@h:8080"},
+      {HTS_MASK_LIST, "tok@h/ http://tok@g/ +*@g/*",
+       "***@h/ http://***@g/ +*@g/*"},
+  };
+
+  static const char *const modes[] = {"list", "addr"};
+  int err = 0;
+  size_t i;
+
+  if (argc >= 2) {
+    char *got = NULL;
+
+    for (i = 0; i < sizeof(modes) / sizeof(modes[0]); i++)
+      if (strcmp(argv[0], modes[i]) == 0)
+        got = hts_mask_passwords(argv[1], (hts_mask_mode) i);
+    if (got == NULL)
+      return 1;
+    printf("%s\n", got);
+    freet(got);
+    return 0;
+  }
+  for (i = 0; i < sizeof(rows) / sizeof(rows[0]); i++)
+    err |= maskpw_row(rows[i].in, rows[i].want, rows[i].mode);
+  err |= nologin_rows(opt);
+  err |= maskpw_pairs(300);
+  err |= maskpw_pairs(10000);
+  printf("maskpw self-test: %s\n", err ? "FAIL" : "OK");
+  return err;
+}
+
 /* #806: hts_localtime() must own its output too, same rationale as
    hts_gmtime() (#794). Reference table computed under TZ=XXX5 (fixed
    UTC-5, no DST), which the driving .test script sets. */
@@ -3513,6 +3832,14 @@ const struct selftest_entry selftests_lib[] = {
      "the fields and copies the span primitive makes", st_span},
     {"gmtime", "",
      "hts_gmtime() fills the caller's buffer, not a static (#794)", st_gmtime},
+    {"secrets", "",
+     "the log hides a password or token it has seen: a token anywhere, a "
+     "short password only as a login",
+     st_secrets},
+    {"maskpw", "[list|addr <text>]",
+     "the command-line echo masks the password of a URL login and nothing "
+     "else",
+     st_maskpw},
     {"localtime", "<dir>",
      "hts_localtime() and get_filetime_rfc822()'s GMT labelling (#806)",
      st_localtime},
diff --git a/src/htsname.c b/src/htsname.c
index 55743ce67..0332fff0f 100644
--- a/src/htsname.c
+++ b/src/htsname.c
@@ -747,7 +747,7 @@ int url_savename(lien_adrfilsave *const afs,
 
           if (r.statuscode != -1) { // cache entry read OK
             hts_log_print(opt, LOG_DEBUG, "Testing link type (from cache) %s%s",
-                          adr_complete, fil_complete);
+                          adr_nologin(opt, adr_complete), fil_complete);
             if (!HTTP_IS_REDIRECT(r.statuscode)) {
               const sniff_src src = {sback, NULL, adr, fil, previous_save};
 
@@ -828,7 +828,7 @@ int url_savename(lien_adrfilsave *const afs,
             current.adr[0] = current.fil[0] = '\0';
             opt->state._hts_in_html_parsing = 2;        // test
             hts_log_print(opt, LOG_DEBUG, "Testing link type %s%s",
-                          adr_complete, fil_complete);
+                          adr_nologin(opt, adr_complete), fil_complete);
             strcpybuff(current.adr, adr_complete);
             strcpybuff(current.fil, fil_complete);
             // ajouter dans le backing le fichier en mode test
@@ -922,8 +922,10 @@ int url_savename(lien_adrfilsave *const afs,
                                 else {
                                   methode = BACK_ADD_TEST2;     // tester avec GET
                                   hts_log_print(opt, LOG_WARNING,
-                                                "Loop with HEAD request (during prefetch) at %s%s",
-                                                current.adr, current.fil);
+                                                "Loop with HEAD request "
+                                                "(during prefetch) at %s%s",
+                                                adr_nologin(opt, current.adr),
+                                                current.fil);
                                 }
                                 if (!hts_wait_available_socket(sback, opt,
                                                                cache, ptr))
@@ -932,12 +934,14 @@ int url_savename(lien_adrfilsave *const afs,
                                              moved.fil, methode, referer_adr,
                                              referer_fil, 1, HTS_FALSE,
                                              NULL) != -1) { // OK
-                                  hts_log_print(opt, LOG_DEBUG,
-                                                "(during prefetch) %s (%d) to link %s at %s%s",
-                                                back[b].r.msg,
-                                                back[b].r.statuscode,
-                                                back[b].r.location, current.adr,
-                                                current.fil);
+                                  hts_log_print(
+                                      opt, LOG_DEBUG,
+                                      "(during prefetch) %s (%d) to link %s at "
+                                      "%s%s",
+                                      back[b].r.msg, back[b].r.statuscode,
+                                      url_nologin(opt, back[b].r.location),
+                                      adr_nologin(opt, current.adr),
+                                      current.fil);
 
                                   // libérer emplacement backing actuel et attendre le prochain
                                   back_maydelete(opt, cache, sback, b);
@@ -953,22 +957,25 @@ int url_savename(lien_adrfilsave *const afs,
                                 } else { // sinon on fait rien et on s'en va..
                                          // (ftp etc)
                                   hts_log_print(opt, LOG_DEBUG,
-                                                "Warning: Savename redirect backing error at %s%s",
-                                                moved.adr, moved.fil);
+                                                "Warning: Savename redirect "
+                                                "backing error at %s%s",
+                                                adr_nologin(opt, moved.adr),
+                                                moved.fil);
                                 }
                               }
                             } else {
-                              hts_log_print(opt, LOG_WARNING,
-                                            "Unable to test %s%s (loop to same filename)",
-                                            adr_complete, fil_complete);
+                              hts_log_print(
+                                  opt, LOG_WARNING,
+                                  "Unable to test %s%s (loop to same filename)",
+                                  adr_nologin(opt, adr_complete), fil_complete);
                             }
 
                           }
                         }
                       } else {  // arrêter les frais
-                        hts_log_print(opt, LOG_WARNING,
-                                      "Unable to test %s%s (loop)",
-                                      adr_complete, fil_complete);
+                        hts_log_print(
+                            opt, LOG_WARNING, "Unable to test %s%s (loop)",
+                            adr_nologin(opt, adr_complete), fil_complete);
                       }
                     }           // ok, leaving
                   }
@@ -1020,8 +1027,8 @@ int url_savename(lien_adrfilsave *const afs,
               printf("error while savename crash adding\n");
 #endif
               hts_log_print(opt, LOG_ERROR,
-                            "Unexpected savename backing error at %s%s", adr,
-                            fil_complete);
+                            "Unexpected savename backing error at %s%s",
+                            adr_nologin(opt, adr), fil_complete);
             }
             // restaurer
             opt->state._hts_in_html_parsing = hihp;
@@ -1052,10 +1059,10 @@ int url_savename(lien_adrfilsave *const afs,
     if ((opt->debug > 1) && (opt->log != NULL)) {
       if (ext_chg == 1)
         hts_log_print(opt, LOG_DEBUG, "Changing link extension %s%s to .%s",
-                      adr_complete, fil_complete, ext);
+                      adr_nologin(opt, adr_complete), fil_complete, ext);
       else
         hts_log_print(opt, LOG_DEBUG, "Changing link name %s%s to %s",
-                      adr_complete, fil_complete, ext);
+                      adr_nologin(opt, adr_complete), fil_complete, ext);
     }
     if (ext_chg == 1) {
       // Cut the old extension only when it is empty (a bare trailing dot), the
@@ -1521,7 +1528,7 @@ int url_savename(lien_adrfilsave *const afs,
     if (*a != '.') {                         // agh pas de point
       strcatbuff(afs->save, ".html");        // préférable!
       hts_log_print(opt, LOG_DEBUG, "Default HTML type set for %s%s => %s",
-                    adr_complete, fil_complete, afs->save);
+                    adr_nologin(opt, adr_complete), fil_complete, afs->save);
     }
   }
   // effacer pass au besoin pour les autentifications
@@ -1666,7 +1673,7 @@ int url_savename(lien_adrfilsave *const afs,
   }
 
   hts_log_print(opt, LOG_DEBUG, "engine: save-name: local name: %s%s -> %s",
-                adr, fil, afs->save);
+                adr_nologin(opt, adr), fil, afs->save);
 
   /* Ensure that the MANDATORY "temporary" extension is set */
   if (ext_chg_delayed) {
@@ -1817,13 +1824,13 @@ int url_savename(lien_adrfilsave *const afs,
         free(saveFinal);
       } else {
         hts_log_print(opt, LOG_ERROR, "Could not revert to UTF-8: %s%s",
-          adr_complete, fil_complete);
+                      adr_nologin(opt, adr_complete), fil_complete);
       }
       free(wsave);
 
       // log in debug
       hts_log_print(opt, LOG_DEBUG, "Too long filename shortened: %s%s => %s",
-        adr_complete, fil_complete, afs->save);
+                    adr_nologin(opt, adr_complete), fil_complete, afs->save);
     } else {
       hts_log_print(opt, LOG_ERROR, "Could not read UTF-8: %s", afs->save);
     }
diff --git a/src/htsopt.h b/src/htsopt.h
index 8fd2d93ce..1a5dbd9e7 100644
--- a/src/htsopt.h
+++ b/src/htsopt.h
@@ -657,6 +657,8 @@ struct httrackp {
                             line, and the last one wins. Tail: ABI */
   hts_boolean accept_given; /**< Did the user give -%a? Tail: ABI */
   hts_boolean lang_given;   /**< Did the user give -%l? Tail: ABI */
+  void *secrets; /**< passwords and tokens the logs hide (htslib.c). Live
+                      state, so copy_htsopt must leave it alone. Tail: ABI */
 };
 
 /** Running statistics for a mirror. */
diff --git a/src/htsparse.c b/src/htsparse.c
index d3e4074df..2df764260 100644
--- a/src/htsparse.c
+++ b/src/htsparse.c
@@ -335,6 +335,28 @@ static const char *html_inline_safe(const char *src, char *dst, size_t size) {
   return dst;
 }
 
+/* Copies the first max bytes of the page text s, len bytes long, into buf
+   for a debug line, with a URL login masked, or "(hidden)" when a login
+   cannot be told apart. */
+static const char *text_excerpt(httrackp *opt, char *buf, size_t size,
+                                const char *s, size_t len, size_t max) {
+  char *copy = malloct(len + 1);
+  const char *shown;
+
+  buf[0] = '\0';
+  if (copy == NULL)
+    return buf;
+  memcpy(copy, s, len);
+  copy[len] = '\0';
+  shown = url_nologin(opt, copy);
+  if (shown == copy && jump_protocol_const(copy) == copy &&
+      strchr(copy, '@') != NULL)
+    shown = "(hidden)";
+  strlncatbuff(buf, shown, size, minimum(strlen(shown), max));
+  freet(copy);
+  return buf;
+}
+
 /* Drop a redirect Location's #fragment: a UA anchor, never part of the fetched
  * resource (#204). */
 static void url_drop_fragment(char *const url) {
@@ -892,8 +914,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
     char *cAddr = r->adr;
     int cSize = (int) r->size;
 
-    hts_log_print(opt, LOG_DEBUG, "engine: preprocess-html: %s%s", urladr(),
-                  urlfil());
+    hts_log_print(opt, LOG_DEBUG, "engine: preprocess-html: %s%s",
+                  adr_nologin(opt, urladr()), urlfil());
     if (RUN_CALLBACK4(opt, preprocess, &cAddr, &cSize, urladr(), urlfil()) == 1) {
       r->adr = cAddr;
       r->size = cSize;
@@ -905,8 +927,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
     const char *lastsaved;            // adresse du dernier octet sauvé + 1
     hts_boolean sf_may_mark = HTS_FALSE; // --single-file: mark this one?
 
-    hts_log_print(opt, LOG_DEBUG, "scanning file %s%s (%s)..", urladr(), urlfil(),
-                  savename());
+    hts_log_print(opt, LOG_DEBUG, "scanning file %s%s (%s)..",
+                  adr_nologin(opt, urladr()), urlfil(), savename());
 
     /* Hack to avoid NULL char problems with C syntax */
     /* Yes, some bogus HTML pages can embed null chars
@@ -1654,14 +1676,15 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                           }
 
                           if ((opt->debug > 1) && (opt->log != NULL)) {
-                            char str[512];
-
-                            str[0] = '\0';
-                            strncatbuff(str, b, minimum((int) (a - b + 1), 32));
-                            hts_log_print(opt, LOG_DEBUG,
-                                          "active code (%s) detected in javascript: %s",
-                                          (check_this_fking_line ==
-                                           2) ? "parse" : "pickup", str);
+                            char str[64];
+
+                            hts_log_print(
+                                opt, LOG_DEBUG,
+                                "active code (%s) detected in javascript: %s",
+                                (check_this_fking_line == 2) ? "parse"
+                                                             : "pickup",
+                                text_excerpt(opt, str, sizeof(str), b,
+                                             (size_t) (a - b + 1), 32));
                           }
                         }
 
@@ -1897,8 +1920,10 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
 #endif
                                       nofollow = 1;     // NE PLUS suivre liens dans cette page
                                       hts_log_print(opt, LOG_WARNING,
-                                                    "Link %s%s not scanned (follow robots meta tag)",
-                                                    urladr(), urlfil());
+                                                    "Link %s%s not scanned "
+                                                    "(follow robots meta tag)",
+                                                    adr_nologin(opt, urladr()),
+                                                    urlfil());
                                     }
                                   }
                                 }
@@ -1954,13 +1979,13 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                     if (hts_js_scan_link(opt, html, r->adr, inscript_tag,
                                          inscript_tag_lastc, incss, &jslink)) {
                       if ((opt->debug > 1) && (opt->log != NULL)) {
-                        char str[512];
+                        char str[64];
 
-                        str[0] = '\0';
-                        strncatbuff(str, html + jslink.offset,
-                                    minimum(jslink.length, 32));
                         hts_log_print(opt, LOG_DEBUG,
-                                      "link detected in javascript: %s", str);
+                                      "link detected in javascript: %s",
+                                      text_excerpt(opt, str, sizeof(str),
+                                                   html + jslink.offset,
+                                                   (size_t) jslink.length, 32));
                       }
                       p = jslink.offset; // p non nul: TRAITER CHAINE COMME
                                          // FICHIER
@@ -2346,8 +2371,14 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
               // a lazy-load placeholder or template is no URL: leave it as is
               if (ok == 0 && dataattr_p &&
                   data_attr_is_not_url(html, (size_t) (eadr - html - 1))) {
-                hts_log_print(opt, LOG_DEBUG, "data attribute is no URL: %.*s",
-                              (int) (eadr - html - 1), html);
+                const size_t len = (size_t) (eadr - html - 1);
+                char *shown = malloct(len + 8);
+
+                if (shown != NULL)
+                  hts_log_print(
+                      opt, LOG_DEBUG, "data attribute is no URL: %s",
+                      text_excerpt(opt, shown, len + 8, html, len, len + 7));
+                freet(shown);
                 not_url = HTS_TRUE;
               }
             }
@@ -2384,14 +2415,15 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                 // 1: interdit (patcher tout de même adresse)
 
                 hts_log_print(opt, LOG_DEBUG, "link detected in html (tag): %s",
-                              lien);
+                              url_nologin(opt, lien));
 
                 // external check
                 if (!RUN_CALLBACK1(opt, linkdetected, lien)
                     || !RUN_CALLBACK2(opt, linkdetected2, lien, intag_start)) {
                   error = 1;    // erreur
                   hts_log_print(opt, LOG_ERROR,
-                                "Link %s refused by external wrapper", lien);
+                                "Link %s refused by external wrapper",
+                                url_nologin(opt, lien));
                 }
 #if HTS_STRIP_DOUBLE_SLASH
                 // supprimer les // en / (sauf pour http://)
@@ -2459,7 +2491,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                   if (strchr(lien, ',')) {
                     error = 1;  // erreur
                     hts_log_print(opt, LOG_DEBUG,
-                                  "link rejected (multiple-archive) %s", lien);
+                                  "link rejected (multiple-archive) %s",
+                                  url_nologin(opt, lien));
                   }
                 }
 
@@ -2499,7 +2532,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                       error = 1;
                       hts_log_print(
                           opt, LOG_DEBUG,
-                          "link rejected (control bytes do not fit) %s", lien);
+                          "link rejected (control bytes do not fit) %s",
+                          url_nologin(opt, lien));
                     }
                   }
 
@@ -2511,8 +2545,10 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                     char *const s = hts_convertStringToUTF8(lien, strlen(lien), charset);
                     if (s != NULL) {
                       hts_log_print(opt, LOG_DEBUG,
-                        "engine: save-name: '%s' charset conversion from '%s' to '%s'",
-                        charset, lien, s);
+                                    "engine: save-name: '%s' charset "
+                                    "conversion from '%s' to '%s'",
+                                    charset, url_nologin(opt, lien),
+                                    url_nologin(opt, s));
                       /* One byte can become three, and a clipped URL names
                          another resource, so drop the link instead. */
                       if (strlen(s) < sizeof(lien) - HTS_LINK_TAIL_ROOM) {
@@ -2522,7 +2558,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                         hts_log_print(
                             opt, LOG_WARNING,
                             "Link is too long after charset conversion: %s",
-                            lien);
+                            url_nologin(opt, lien));
                       }
                       free(s);
                     }
@@ -2531,7 +2567,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                   // decode URI entities with UTF-8 charset
                   if (hts_unescapeEntities(lien, lien, strlen(lien) + 1) != 0) {
                     hts_log_print(opt, LOG_WARNING,
-                      "could not decode URI '%s' with charset '%s'", lien, charset);
+                                  "could not decode URI '%s' with charset '%s'",
+                                  url_nologin(opt, lien), charset);
                   }
 
                   // decode query entities with the page charset, out-of-place
@@ -2559,7 +2596,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                     strcpybuff(lien, catbuff);
                   } else {
                     hts_log_print(opt, LOG_WARNING,
-                      "could not URL-decode string '%s'", lien);
+                                  "could not URL-decode string '%s'",
+                                  url_nologin(opt, lien));
                   }
 
                   // we need to encode query string non-ascii chars,
@@ -2576,7 +2614,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                       error = 1;
                       hts_log_print(opt, LOG_DEBUG,
                                     "link rejected (query does not fit) %s",
-                                    lien);
+                                    url_nologin(opt, lien));
                     }
                   }
                 }
@@ -2666,7 +2704,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                 }
                 // si c'est un chemin, alors vérifier (toto/toto.html -> http://www/toto/)
                 if (!error) {
-                  hts_log_print(opt, LOG_DEBUG, "position link check %s", lien);
+                  hts_log_print(opt, LOG_DEBUG, "position link check %s",
+                                url_nologin(opt, lien));
 
                   if ((p_type == 2) || (p_type == -2)) {        // code ou codebase                        
                     // Vérifier les codebase=applet (au lieu de applet/)
@@ -2709,7 +2748,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                         error = 1;
                         hts_log_print(opt, LOG_WARNING,
                                       "Link is too long once resolved: %s",
-                                      lien);
+                                      url_nologin(opt, lien));
                       } else {
                         strcpybuff(lien, "http://");
                         strcatbuff(lien, af2.adr);
@@ -2762,9 +2801,9 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                       } break; // base
                       }
 
-                      hts_log_print(opt, LOG_DEBUG,
-                                    "code/codebase link %s base %s", lien,
-                                    base);
+                      hts_log_print(
+                          opt, LOG_DEBUG, "code/codebase link %s base %s",
+                          url_nologin(opt, lien), url_nologin(opt, base));
                     }
 
                   } else {
@@ -2792,15 +2831,16 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                               strcpybuff(lien, tempo);  // patcher en considérant base
                               // ** vérifier que ../ fonctionne (ne doit pas arriver mais bon..)
 
-                              hts_log_print(opt, LOG_DEBUG,
-                                            "link modified with code/codebase %s",
-                                            lien);
+                              hts_log_print(
+                                  opt, LOG_DEBUG,
+                                  "link modified with code/codebase %s",
+                                  url_nologin(opt, lien));
                             }
                           } else {
                             error = 1;  // erreur
                             hts_log_print(opt, LOG_ERROR,
                                           "Link %s too long with base href",
-                                          lien);
+                                          url_nologin(opt, lien));
                           }
                         } else {
                           lien_adrfil baseaf;
@@ -2817,14 +2857,15 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                               strcatbuff(tempo, lien);
                               strcpybuff(lien, tempo);  // patcher en considérant base
 
-                              hts_log_print(opt, LOG_DEBUG,
-                                            "link modified with code/codebase %s",
-                                            lien);
+                              hts_log_print(
+                                  opt, LOG_DEBUG,
+                                  "link modified with code/codebase %s",
+                                  url_nologin(opt, lien));
                             } else {
                               error = 1;        // erreur
                               hts_log_print(opt, LOG_ERROR,
                                             "Link %s too long with base href",
-                                            lien);
+                                            url_nologin(opt, lien));
                             }
                           }
                         }
@@ -2838,9 +2879,10 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                 if (!error) {
                   int reponse;
 
-                  hts_log_print(opt, LOG_DEBUG,
-                                "build relative link %s with %s%s", lien,
-                                relativeurladr(), relativeurlfil());
+                  hts_log_print(
+                      opt, LOG_DEBUG, "build relative link %s with %s%s",
+                      url_nologin(opt, lien),
+                      adr_nologin(opt, relativeurladr()), relativeurlfil());
                   if ((reponse =
                        ident_url_relatif(lien, relativeurladr(), relativeurlfil(),
                                          &afs.af)) < 0) {
@@ -2849,22 +2891,26 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                       hts_log_print(opt, LOG_WARNING,
                                     "Link %s not caught (protocol not "
                                     "supported by this build)",
-                                    lien);
+                                    url_nologin(opt, lien));
                     } else {
                       hts_log_print(opt, LOG_DEBUG,
                                     "ident_url_relatif failed for %s with %s%s",
-                                    lien, relativeurladr(), relativeurlfil());
+                                    url_nologin(opt, lien),
+                                    adr_nologin(opt, relativeurladr()),
+                                    relativeurlfil());
                     }
                   } else {
                     hts_log_print(opt, LOG_DEBUG,
                                   "built relative link %s with %s%s -> %s%s",
-                                  lien, relativeurladr(), relativeurlfil(), afs.af.adr,
-                                  afs.af.fil);
+                                  url_nologin(opt, lien),
+                                  adr_nologin(opt, relativeurladr()),
+                                  relativeurlfil(),
+                                  adr_nologin(opt, afs.af.adr), afs.af.fil);
                   }
                 } else {
                   hts_log_print(opt, LOG_DEBUG,
                                 "link %s not build, error detected before",
-                                lien);
+                                url_nologin(opt, lien));
                   afs.af.adr[0] = '\0';
                 }
 
@@ -2873,7 +2919,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                 if (p_nocatch) {
                   forbidden_url = 1;    // interdire récupération du lien
                   hts_log_print(opt, LOG_DEBUG, "link forced external at %s%s",
-                                afs.af.adr, afs.af.fil);
+                                adr_nologin(opt, afs.af.adr), afs.af.fil);
                 }
                 // Tester si un lien doit être accepté ou refusé (wizard)
                 // forbidden_url=1 : lien refusé
@@ -2882,7 +2928,8 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                   if (!p_nocatch) {
                     if (afs.af.adr[0] != '\0') {
                       hts_log_print(opt, LOG_DEBUG,
-                                    "wizard link test at %s%s..", afs.af.adr, afs.af.fil);
+                                    "wizard link test at %s%s..",
+                                    adr_nologin(opt, afs.af.adr), afs.af.fil);
                       forbidden_url =
                           hts_acceptlink(opt, ptr, afs.af.adr, afs.af.fil,
                                          intag_name ? intag_name : NULL,
@@ -2943,9 +2990,10 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                         if ((ptr > 0) && (p_type != 2) && (p_type != -2)) {     // tester autorisations?
                           if (!p_nocatch) {
                             if (afs.af.adr[0] != '\0') {
-                              hts_log_print(opt, LOG_DEBUG,
-                                            "wizard moved link retest at %s%s..",
-                                            afs.af.adr, afs.af.fil);
+                              hts_log_print(
+                                  opt, LOG_DEBUG,
+                                  "wizard moved link retest at %s%s..",
+                                  adr_nologin(opt, afs.af.adr), afs.af.fil);
                               forbidden_url = hts_acceptlink(
                                   opt, ptr, afs.af.adr, afs.af.fil,
                                   intag_name ? intag_name : NULL,
@@ -3008,23 +3056,27 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                       if (forbidden_url != 1) { // le lien va être chargé
                         if ((p_type == 2) || (p_type == -2)) {  // base href ou codebase, pas un lien
                           hts_log_print(opt, LOG_DEBUG, "Code/Codebase: %s%s",
-                                        afs.af.adr, afs.af.fil);
+                                        adr_nologin(opt, afs.af.adr),
+                                        afs.af.fil);
                         } else if ((opt->getmode & HTS_GETMODE_HTML_FIRST) ==
                                    0) {
                           hts_log_print(opt, LOG_DEBUG, "Record: %s%s -> %s",
-                                        afs.af.adr, afs.af.fil, afs.save);
+                                        adr_nologin(opt, afs.af.adr),
+                                        afs.af.fil, afs.save);
                         } else {
                           if (!ishtml(opt, afs.af.fil))
                             hts_log_print(opt, LOG_DEBUG,
-                                          "Record after: %s%s -> %s", afs.af.adr, afs.af.fil,
-                                          afs.save);
+                                          "Record after: %s%s -> %s",
+                                          adr_nologin(opt, afs.af.adr),
+                                          afs.af.fil, afs.save);
                           else
                             hts_log_print(opt, LOG_DEBUG, "Record: %s%s -> %s",
-                                          afs.af.adr, afs.af.fil, afs.save);
+                                          adr_nologin(opt, afs.af.adr),
+                                          afs.af.fil, afs.save);
                         }
                       } else
-                        hts_log_print(opt, LOG_DEBUG, "External: %s%s", afs.af.adr,
-                                      afs.af.fil);
+                        hts_log_print(opt, LOG_DEBUG, "External: %s%s",
+                                      adr_nologin(opt, afs.af.adr), afs.af.fil);
                     }
                     /* FIN log */
 
@@ -3409,9 +3461,11 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                           if (ending_p == ')')
                             escape_url_parens(tempo, sizeof(tempo));
                         }
-                        hts_log_print(opt, LOG_DEBUG,
-                                      "relative link at %s build with %s and %s: %s",
-                                      afs.af.adr, afs.save, relativesavename(), tempo);
+                        hts_log_print(
+                            opt, LOG_DEBUG,
+                            "relative link at %s build with %s and %s: %s",
+                            adr_nologin(opt, afs.af.adr), afs.save,
+                            relativesavename(), tempo);
 
                         // lien applet (code) - il faut placer un codebase avant
                         if (p_type == -1) {     // que le nom de fichier
@@ -3576,10 +3630,12 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                             if ((opt->debug > 1) && (opt->log != NULL)) {
                               if (strcmp(afs.af.adr, heap(i)->adr) != 0
                                   || strcmp(afs.af.fil, heap(i)->fil) != 0) {
-                                hts_log_print(opt, LOG_DEBUG,
-                                              "merging similar links %s%s and %s%s",
-                                              afs.af.adr, afs.af.fil, heap(i)->adr,
-                                              heap(i)->fil);
+                                hts_log_print(
+                                    opt, LOG_DEBUG,
+                                    "merging similar links %s%s and %s%s",
+                                    adr_nologin(opt, afs.af.adr), afs.af.fil,
+                                    adr_nologin(opt, heap(i)->adr),
+                                    heap(i)->fil);
                               }
                             }
                             heap(i)->depth =
@@ -3631,9 +3687,10 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                                         ("robots.txt: added file robots.txt for %s\n",
                                          adr);
 #endif
-                                      hts_log_print(opt, LOG_DEBUG,
-                                                    "robots.txt added at %s",
-                                                    afs.af.adr);
+                                      hts_log_print(
+                                          opt, LOG_DEBUG,
+                                          "robots.txt added at %s",
+                                          adr_nologin(opt, afs.af.adr));
                                     } else {
                                       hts_log_print(opt, LOG_ERROR,
                                                     "Unexpected robots.txt error at %d",
@@ -3690,12 +3747,11 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
                           if (!just_test_it) {
                             hts_log_print(opt, LOG_DEBUG,
                                           "OK, NOTE: %s%s -> %s",
-                                          heap_top()->adr,
-                                          heap_top()->fil,
-                                          heap_top()->sav);
+                                          adr_nologin(opt, heap_top()->adr),
+                                          heap_top()->fil, heap_top()->sav);
                           } else {
                             hts_log_print(opt, LOG_DEBUG, "OK, TEST: %s%s",
-                                          heap_top()->adr,
+                                          adr_nologin(opt, heap_top()->adr),
                                           heap_top()->fil);
                           }
 
@@ -3851,7 +3907,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
           int cSize = (int) TypedArraySize(output_buffer);
 
           hts_log_print(opt, LOG_DEBUG, "engine: postprocess-html: %s%s",
-                        urladr(), urlfil());
+                        adr_nologin(opt, urladr()), urlfil());
           if (RUN_CALLBACK4(opt, postprocess, &cAddr, &cSize, urladr(), urlfil()) == 1) {
             hts_log_print(opt, LOG_DEBUG,
               "engine: postprocess-html: callback modified data, applying %d bytes", cSize);
@@ -3866,7 +3922,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
               hts_log_print(opt, LOG_ERROR,
                             "engine: postprocess-html: callback returned %d "
                             "bytes for %s%s, page skipped",
-                            cSize, urladr(), urlfil());
+                            cSize, adr_nologin(opt, urladr()), urlfil());
               HT_SET_SIZE(0);
               error = 1;
             } else if (hts_postprocess_reply_inplace(
@@ -3885,7 +3941,7 @@ int htsparse(htsmoduleStruct * str, htsmoduleStructExtended * stre) {
         if (output_oom) {
           hts_log_print(opt, LOG_ERROR,
                         "Not enough memory to rewrite %s%s, page skipped",
-                        urladr(), urlfil());
+                        adr_nologin(opt, urladr()), urlfil());
           error = 1;
         } else if (TypedArraySize(output_buffer) != 0) {
           hts_finish_html_file(
@@ -4023,7 +4079,8 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
     // ------------------------------------------------------------
     if (HTTP_IS_REDIRECT(r->statuscode)) {
 
-      hts_log_print(opt, LOG_WARNING, "%s for %s%s", r->msg, urladr(), urlfil());
+      hts_log_print(opt, LOG_WARNING, "%s for %s%s", r->msg,
+                    adr_nologin(opt, urladr()), urlfil());
 
       {
         char BIGSTK mov_url[HTS_URLMAXSIZE * 2];
@@ -4058,7 +4115,7 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
               get_it = -1;      // ne rien faire
               hts_log_print(opt, LOG_WARNING,
                             "Can not bear crazy server (%s) for %s%s", r->msg,
-                            urladr(), urlfil());
+                            adr_nologin(opt, urladr()), urlfil());
             } else {            // mauvaise casse, effacer entrée dans la pile et rejouer une fois
               get_it = 1;
             }
@@ -4067,14 +4124,14 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
               // -> on prend à cette adresse, le lien sera enregistré avec lien_record() (hash)
               hts_log_print(opt, LOG_DEBUG,
                             "wizard link test for moved file at %s%s..",
-                            moved->adr, moved->fil);
+                            adr_nologin(opt, moved->adr), moved->fil);
               // accepté?
               if (hts_acceptlink(opt, ptr, moved->adr, moved->fil, NULL, NULL,
                                  HTS_FALSE, &set_prio_to, NULL) !=
                   1) { /* nouvelle adresse non refusée ? */
                 get_it = 1;
                 hts_log_print(opt, LOG_DEBUG, "moved link accepted: %s%s",
-                              moved->adr, moved->fil);
+                              adr_nologin(opt, moved->adr), moved->fil);
               }
             } else if (same_savefile) {
               // A stub would point at itself; follow the redirect instead.
@@ -4084,7 +4141,8 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
                 hts_log_print(opt, LOG_WARNING,
                               "Redirect to a same-file alias, fetching real "
                               "content: %s%s -> %s%s",
-                              urladr(), urlfil(), moved->adr, moved->fil);
+                              adr_nologin(opt, urladr()), urlfil(),
+                              adr_nologin(opt, moved->adr), moved->fil);
               }
             } /* sinon traité normalement */
           }
@@ -4094,7 +4152,8 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
             // et reculer pour mieux sauter
             hts_log_print(opt, LOG_WARNING,
                           "Warning moved treated for %s%s (real one is %s%s)",
-                          urladr(), urlfil(), moved->adr, moved->fil);
+                          adr_nologin(opt, urladr()), urlfil(),
+                          adr_nologin(opt, moved->adr), moved->fil);
             // canceller lien actuel
             error = 1;
             hts_invalidate_link(opt, ptr);  // invalidate hashtable entry
@@ -4153,7 +4212,8 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
           char *const rn = (char *) malloct(rn_size);
           if (rn != NULL) {
             hts_log_print(opt, LOG_WARNING, "File has moved from %s%s to %s",
-                          urladr(), urlfil(), mov_url);
+                          adr_nologin(opt, urladr()), urlfil(),
+                          url_nologin(opt, mov_url));
             if (!opt->mimehtml) {
               inplace_escape_uri(mov_url, sizeof(mov_url));
             } else {
@@ -4226,7 +4286,7 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
       // gone; a failed removal gives up rather than looping.
       if (had_partial && ref_gone && !fexist_utf8(heap(ptr)->sav)) {
         hts_log_print(opt, LOG_DEBUG, "Partial file reget (%s) for %s%s",
-                      r->msg, urladr(), urlfil());
+                      r->msg, adr_nologin(opt, urladr()), urlfil());
         if (hts_record_link(opt, heap(ptr)->adr, heap(ptr)->fil, heap(ptr)->sav, "", "", NULL)) {
           heap_top()->testmode = heap(ptr)->testmode;
           heap_top()->link_import = 0;
@@ -4246,7 +4306,7 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
       } else {
         hts_log_print(opt, LOG_WARNING,
                       "Giving up on partial reget (%s) for %s%s", r->msg,
-                      urladr(), urlfil());
+                      adr_nologin(opt, urladr()), urlfil());
         error = 1;
       }
 
@@ -4268,11 +4328,12 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
         if (opt->hostcontrol) { // timeout et retry épuisés
           if ((opt->hostcontrol & HTS_HOSTCONTROL_BAN_TIMEOUT) &&
               (heap(ptr)->retry <= 0)) {
-            hts_log_print(opt, LOG_DEBUG, "Link banned: %s%s", urladr(), urlfil());
+            hts_log_print(opt, LOG_DEBUG, "Link banned: %s%s",
+                          adr_nologin(opt, urladr()), urlfil());
             host_ban(opt, ptr, sback, jump_identification_const(urladr()));
             hts_log_print(opt, LOG_DEBUG,
-                          "Info: previous log - link banned: %s%s", urladr(),
-                          urlfil());
+                          "Info: previous log - link banned: %s%s",
+                          adr_nologin(opt, urladr()), urlfil());
           } else
             can_retry = 1;
         } else
@@ -4281,11 +4342,12 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
       case STATUSCODE_SLOW:
         if ((opt->hostcontrol) && (heap(ptr)->retry <= 0)) {   // too slow
           if (opt->hostcontrol & HTS_HOSTCONTROL_BAN_SLOW) {
-            hts_log_print(opt, LOG_DEBUG, "Link banned: %s%s", urladr(), urlfil());
+            hts_log_print(opt, LOG_DEBUG, "Link banned: %s%s",
+                          adr_nologin(opt, urladr()), urlfil());
             host_ban(opt, ptr, sback, jump_identification_const(urladr()));
             hts_log_print(opt, LOG_DEBUG,
-                          "Info: previous log - link banned: %s%s", urladr(),
-                          urlfil());
+                          "Info: previous log - link banned: %s%s",
+                          adr_nologin(opt, urladr()), urlfil());
           } else
             can_retry = 1;
         } else
@@ -4326,26 +4388,28 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
         // give up: no free restart left, and no budget (or nothing to retry)
         if (!restart_whole && ((heap(ptr)->retry <= 0) || (!can_retry))) {
           if ((opt->retry > 0) && (can_retry)) {
-            hts_log_print(opt, LOG_ERROR,
-                          "\"%s\" (%d) after %d retries at link %s%s (from %s%s)",
-                          r->msg, r->statuscode, opt->retry, urladr(), urlfil(),
-                          heap(heap(ptr)->precedent)->adr,
-                          heap(heap(ptr)->precedent)->fil);
+            hts_log_print(
+                opt, LOG_ERROR,
+                "\"%s\" (%d) after %d retries at link %s%s (from %s%s)", r->msg,
+                r->statuscode, opt->retry, adr_nologin(opt, urladr()), urlfil(),
+                adr_nologin(opt, heap(heap(ptr)->precedent)->adr),
+                heap(heap(ptr)->precedent)->fil);
           } else {
             if (r->statuscode == STATUSCODE_TEST_OK) {  // test OK
               hts_log_print(opt, LOG_INFO, "Test OK at link %s%s (from %s%s)",
-                            urladr(), urlfil(), heap(heap(ptr)->precedent)->adr,
+                            adr_nologin(opt, urladr()), urlfil(),
+                            adr_nologin(opt, heap(heap(ptr)->precedent)->adr),
                             heap(heap(ptr)->precedent)->fil);
             } else {
               if (strcmp(urlfil(), "/robots.txt")) {      // ne pas afficher d'infos sur robots.txt par défaut
-                hts_log_print(opt, LOG_ERROR,
-                              "\"%s\" (%d) at link %s%s (from %s%s)", r->msg,
-                              r->statuscode, urladr(), urlfil(),
-                              heap(heap(ptr)->precedent)->adr,
-                              heap(heap(ptr)->precedent)->fil);
+                hts_log_print(
+                    opt, LOG_ERROR, "\"%s\" (%d) at link %s%s (from %s%s)",
+                    r->msg, r->statuscode, adr_nologin(opt, urladr()), urlfil(),
+                    adr_nologin(opt, heap(heap(ptr)->precedent)->adr),
+                    heap(heap(ptr)->precedent)->fil);
               } else {
                 hts_log_print(opt, LOG_DEBUG, "No robots.txt rules at %s",
-                              urladr());
+                              adr_nologin(opt, urladr()));
               }
             }
           }
@@ -4403,14 +4467,16 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
             hts_log_print(opt, LOG_NOTICE,
                           "Restarting whole file after error %d (%s) at link "
                           "%s%s (from %s%s)",
-                          r->statuscode, r->msg, urladr(), urlfil(),
-                          heap(heap(ptr)->precedent)->adr,
+                          r->statuscode, r->msg, adr_nologin(opt, urladr()),
+                          urlfil(),
+                          adr_nologin(opt, heap(heap(ptr)->precedent)->adr),
                           heap(heap(ptr)->precedent)->fil);
           } else {
             hts_log_print(opt, LOG_NOTICE,
                           "Retry after error %d (%s) at link %s%s (from %s%s)",
-                          r->statuscode, r->msg, urladr(), urlfil(),
-                          heap(heap(ptr)->precedent)->adr,
+                          r->statuscode, r->msg, adr_nologin(opt, urladr()),
+                          urlfil(),
+                          adr_nologin(opt, heap(heap(ptr)->precedent)->adr),
                           heap(heap(ptr)->precedent)->fil);
           }
           // re-request the file
@@ -4431,8 +4497,8 @@ int hts_mirror_check_moved(htsmoduleStruct * str,
           }
         }
       } else {
-        hts_log_print(opt, LOG_DEBUG, "Info: no robots.txt at %s%s", urladr(),
-                      urlfil());
+        hts_log_print(opt, LOG_DEBUG, "Info: no robots.txt at %s%s",
+                      adr_nologin(opt, urladr()), urlfil());
       }
       if (!store_errpage) {
         if (r->adr) {           // désalloc
@@ -4592,8 +4658,8 @@ void hts_mirror_process_user_interaction(htsmoduleStruct * str,
              that name is the bug. */
           if (forbidden_url == 1 || IS_DELAYED_EXT(add.save)) {
             hts_log_print(opt, LOG_NOTICE,
-                          "Link %s%s not added after user request", add.af.adr,
-                          add.af.fil);
+                          "Link %s%s not added after user request",
+                          adr_nologin(opt, add.af.adr), add.af.fil);
           } else if (hash_read(hash, add.save, NULL, HASH_STRUCT_FILENAME) <
                      0) { // no existing record
             // record the link
@@ -4607,8 +4673,8 @@ void hts_mirror_process_user_interaction(htsmoduleStruct * str,
               heap_top()->premier = heap_top_index();
               heap_top()->precedent = heap_top_index();
               //
-              hts_log_print(opt, LOG_INFO, "Link added by user: %s%s", add.af.adr,
-                            add.af.fil);
+              hts_log_print(opt, LOG_INFO, "Link added by user: %s%s",
+                            adr_nologin(opt, add.af.adr), add.af.fil);
               //
             } else if (hts_maxlinks_no_room(opt)) {
               /* Give the parser's verdict rather than dropping the rest of
@@ -4623,12 +4689,12 @@ void hts_mirror_process_user_interaction(htsmoduleStruct * str,
           } else {
             hts_log_print(opt, LOG_NOTICE,
                           "Existing link %s%s not added after user request",
-                          add.af.adr, add.af.fil);
+                          adr_nologin(opt, add.af.adr), add.af.fil);
           }
         }
       } else {
         hts_log_print(opt, LOG_ERROR, "Error during URL decoding for %s",
-                      add_url);
+                      url_nologin(opt, add_url));
       }
       // ----Fin Ajout----
     }
@@ -4692,8 +4758,8 @@ int hts_mirror_wait_for_next_file(htsmoduleStruct * str,
 
   /* This is not supposed to hapen. */
   if (heap(ptr)->pass2 == -1) {
-    hts_log_print(opt, LOG_WARNING, "Link is already ready %s%s", urladr(),
-                  urlfil());
+    hts_log_print(opt, LOG_WARNING, "Link is already ready %s%s",
+                  adr_nologin(opt, urladr()), urlfil());
   }
 
   /* User interaction */
@@ -4705,7 +4771,8 @@ int hts_mirror_wait_for_next_file(htsmoduleStruct * str,
 
   /* Done while processing user interactions ? */
   if (heap(ptr)->pass2 == -1) {
-    hts_log_print(opt, LOG_DEBUG, "Link is now ready %s%s", urladr(), urlfil());
+    hts_log_print(opt, LOG_DEBUG, "Link is now ready %s%s",
+                  adr_nologin(opt, urladr()), urlfil());
     // We are ready
     return 2;                   // goto jump_if_done;
   }
@@ -4724,7 +4791,7 @@ int hts_mirror_wait_for_next_file(htsmoduleStruct * str,
       printf("error while crash adding\n");
 #endif
       hts_log_print(opt, LOG_ERROR, "Unexpected backing error for %s%s",
-                    urladr(), urlfil());
+                    adr_nologin(opt, urladr()), urlfil());
     }
   }
 #if BDEBUG==1
@@ -4974,7 +5041,7 @@ int hts_mirror_wait_for_next_file(htsmoduleStruct * str,
     if (b < 0) {
       hts_log_print(opt, LOG_DEBUG,
                     "link #%d is ready, no more on the stack, skipping: %s%s..",
-                    ptr, urladr(), urlfil());
+                    ptr, adr_nologin(opt, urladr()), urlfil());
 
       return 2; // goto jump_if_done;
     }
@@ -4992,11 +5059,12 @@ int hts_mirror_wait_for_next_file(htsmoduleStruct * str,
       if (b >= 0) {
         if (back[b].r.statuscode == HTTP_OK)
           printf("%d/%d: %s%s (" LLintP " bytes) - OK\n", ptr, opt->lien_tot,
-                 back[b].url_adr, back[b].url_fil, (LLint) back[b].r.size);
+                 adr_nologin(opt, back[b].url_adr), back[b].url_fil,
+                 (LLint) back[b].r.size);
         else
           printf("%d/%d: %s%s (" LLintP " bytes) - %d\n", ptr, opt->lien_tot,
-                 back[b].url_adr, back[b].url_fil, (LLint) back[b].r.size,
-                 back[b].r.statuscode);
+                 adr_nologin(opt, back[b].url_adr), back[b].url_fil,
+                 (LLint) back[b].r.size, back[b].r.statuscode);
       } else {
         hts_log_print(opt, LOG_ERROR, "Link disappeared");
       }
@@ -5088,8 +5156,8 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
     char BIGSTK
         cookie_before[16384]; /* #15: this URL's Cookie header, pre-request */
 
-    hts_log_print(opt, LOG_DEBUG, "Waiting for type to be known: %s%s", afs->af.adr,
-                  afs->af.fil);
+    hts_log_print(opt, LOG_DEBUG, "Waiting for type to be known: %s%s",
+                  adr_nologin(opt, afs->af.adr), afs->af.fil);
 
     /* Follow while type is unknown and redirects occurs */
     for(loops = 0, continue_loop = 1;
@@ -5132,9 +5200,10 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
                             new_forbidden_url);
               if (new_forbidden_url == 1) {
                 *forbidden_url = new_forbidden_url;
-                hts_log_print(opt, LOG_DEBUG,
-                              "link forbidden because of MIME types restrictions: %s%s",
-                              afs->af.adr, afs->af.fil);
+                hts_log_print(
+                    opt, LOG_DEBUG,
+                    "link forbidden because of MIME types restrictions: %s%s",
+                    adr_nologin(opt, afs->af.adr), afs->af.fil);
                 break;          // exit loop
               }
             }
@@ -5148,9 +5217,10 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
       /* Check if the file was recorded already (necessary for redirects) */
       if (hash_read(hash, afs->save, NULL, HASH_STRUCT_FILENAME) >= 0) {
         if (loops == 0) {       /* Should not happend */
-          hts_log_print(opt, LOG_ERROR,
-                        "Duplicate entry in hts_wait_delayed() cancelled: %s%s -> %s",
-                        afs->af.adr, afs->af.fil, afs->save);
+          hts_log_print(
+              opt, LOG_ERROR,
+              "Duplicate entry in hts_wait_delayed() cancelled: %s%s -> %s",
+              adr_nologin(opt, afs->af.adr), afs->af.fil, afs->save);
         }
         /* Exit loop (we're done) */
         continue_loop = 0;
@@ -5208,9 +5278,10 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
                             *forbidden_url);
               if (new_forbidden_url == 1) {
                 *forbidden_url = new_forbidden_url;
-                hts_log_print(opt, LOG_DEBUG,
-                              "link forbidden because of MIME types restrictions: %s%s",
-                              afs->af.adr, afs->af.fil);
+                hts_log_print(
+                    opt, LOG_DEBUG,
+                    "link forbidden because of MIME types restrictions: %s%s",
+                    adr_nologin(opt, afs->af.adr), afs->af.fil);
                 break;          // exit loop
               }
             }
@@ -5338,7 +5409,8 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
               if (ident_url_relatif(mov_url, afs->af.adr, afs->af.fil, &moved) >= 0) {
                 hts_log_print(opt, LOG_DEBUG,
                               "Redirect while resolving type: %s%s -> %s%s",
-                              afs->af.adr, afs->af.fil, moved.adr, moved.fil);
+                              adr_nologin(opt, afs->af.adr), afs->af.fil,
+                              adr_nologin(opt, moved.adr), moved.fil);
                 // si non bouclage sur soi même, ou si test avec GET non testé
                 if (strcmp(moved.adr, afs->af.adr) != 0 || strcmp(moved.fil, afs->af.fil) != 0) {
 
@@ -5360,8 +5432,10 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
                        * this error, and we'll only issue ONE request */
                       *forbidden_url = 1;       /* Forbidden! */
                       hts_log_print(opt, LOG_DEBUG,
-                                    "link forbidden because of redirect beyond the mirror scope at %s%s -> %s%s",
-                                    afs->af.adr, afs->af.fil, moved.adr, moved.fil);
+                                    "link forbidden because of redirect beyond "
+                                    "the mirror scope at %s%s -> %s%s",
+                                    adr_nologin(opt, afs->af.adr), afs->af.fil,
+                                    adr_nologin(opt, moved.adr), moved.fil);
                       strcpybuff(afs->af.adr, moved.adr);
                       strcpybuff(afs->af.fil, moved.fil);
                       mov_url[0] = '\0';
@@ -5402,12 +5476,13 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
                 } else {
                   hts_log_print(opt, LOG_WARNING,
                                 "Unable to test %s%s (loop to same filename)",
-                                afs->af.adr, afs->af.fil);
+                                adr_nologin(opt, afs->af.adr), afs->af.fil);
                 } // loop to same location
               }                 // ident_url_relatif()
             }                   // location
           }                     // redirect
-          hts_log_print(opt, LOG_DEBUG, "Final type for %s%s: '%s'", afs->af.adr, afs->af.fil,
+          hts_log_print(opt, LOG_DEBUG, "Final type for %s%s: '%s'",
+                        adr_nologin(opt, afs->af.adr), afs->af.fil,
                         delayed_back.r.contenttype);
 
           /* If we are done, do additional checks with final type and authorizations */
@@ -5435,9 +5510,10 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
                               *forbidden_url);
                 if (new_forbidden_url == 1) {
                   *forbidden_url = new_forbidden_url;
-                  hts_log_print(opt, LOG_DEBUG,
-                                "link forbidden because of MIME types restrictions: %s%s",
-                                afs->af.adr, afs->af.fil);
+                  hts_log_print(
+                      opt, LOG_DEBUG,
+                      "link forbidden because of MIME types restrictions: %s%s",
+                      adr_nologin(opt, afs->af.adr), afs->af.fil);
                   break;        // exit loop
                 }
               }
@@ -5480,11 +5556,13 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
         if (in_error == STATUSCODE_TOO_BIG) {
           hts_log_print(opt, LOG_INFO,
                         "link not taken because of its size (%d bytes) at %s%s",
-                        (int) in_error_size, afs->af.adr, afs->af.fil);
+                        (int) in_error_size, adr_nologin(opt, afs->af.adr),
+                        afs->af.fil);
         } else {
           hts_log_print(opt, LOG_INFO,
                         "link not taken because of error (%d '%s') at %s%s",
-                        in_error, in_error_msg, afs->af.adr, afs->af.fil);
+                        in_error, in_error_msg, adr_nologin(opt, afs->af.adr),
+                        afs->af.fil);
         }
       }
     }
@@ -5494,15 +5572,16 @@ int hts_wait_delayed(htsmoduleStruct *str, lien_adrfilsave *afs,
       if (cancelled) {
         hts_log_print(opt, LOG_DEBUG,
                       "link cancelled, type unknown, left online: %s%s",
-                      afs->af.adr, afs->af.fil);
+                      adr_nologin(opt, afs->af.adr), afs->af.fil);
       } else if (in_error) {
         hts_log_print(opt, LOG_WARNING,
                       "link in error (%d '%s'), type unknown, aborting: %s%s",
-                      in_error, in_error_msg, afs->af.adr, afs->af.fil);
+                      in_error, in_error_msg, adr_nologin(opt, afs->af.adr),
+                      afs->af.fil);
       } else {
         hts_log_print(opt, LOG_WARNING,
                       "link is probably looping, type unknown, aborting: %s%s",
-                      afs->af.adr, afs->af.fil);
+                      adr_nologin(opt, afs->af.adr), afs->af.fil);
       }
     }
 
diff --git a/src/htsproxy.c b/src/htsproxy.c
index 00b01eaac..3ce0162a1 100644
--- a/src/htsproxy.c
+++ b/src/htsproxy.c
@@ -123,6 +123,7 @@ int http_proxy_tunnel(httrackp *opt, htsblk *retour, const char *adr,
                                         OPT_GET_BUFF_SIZE(opt), user_pass));
     code64((unsigned char *) user_pass, (int) strlen(user_pass),
            (unsigned char *) autorisation, 0);
+    hts_secret_add(opt, autorisation, strlen(autorisation), HTS_SECRET_HEADER);
     strlcatbuff(req, "Proxy-Authorization: Basic ", sizeof(req));
     strlcatbuff(req, autorisation, sizeof(req));
     strlcatbuff(req, H_CRLF, sizeof(req));
diff --git a/src/htsrobots.c b/src/htsrobots.c
index 87c34d5f3..ee092ff85 100644
--- a/src/htsrobots.c
+++ b/src/htsrobots.c
@@ -258,8 +258,8 @@ void robots_parse(httrackp *opt, robots_wizard *robots, const char *adr,
     hts_log_print(opt, LOG_WARNING,
                   "robots.txt for %s: %d rule(s) not honoured as written, "
                   "starting with '%s' (rules kept up to %d bytes, lines to %d)",
-                  adr, ndropped, dropped, (int) HTS_ROBOTS_MAX_TOKEN_SIZE,
-                  (int) HTS_ROBOTS_LINE_SIZE);
+                  adr_nologin(opt, adr), ndropped, dropped,
+                  (int) HTS_ROBOTS_MAX_TOKEN_SIZE, (int) HTS_ROBOTS_LINE_SIZE);
   if (StringNotEmpty(blob))
     checkrobots_set(robots, adr, StringBuff(blob));
   StringFree(blob);
diff --git a/src/htssitemap.c b/src/htssitemap.c
index 99f5f8011..683de5bb0 100644
--- a/src/htssitemap.c
+++ b/src/htssitemap.c
@@ -292,7 +292,7 @@ static hts_boolean sitemap_fetch_allowed(httrackp *opt, const char *adr,
   refused = (jok == -1) ? HTS_TRUE : HTS_FALSE;
   if (refused) {
     hts_log_print(opt, LOG_NOTICE, "Sitemap: filter rule #%d refuses %s%s",
-                  jokdepth + 1, adr, fil);
+                  jokdepth + 1, adr_nologin(opt, adr), fil);
     return HTS_FALSE;
   }
   /* A Sitemap: line, or a sitemapindex entry, is the site inviting the fetch;
@@ -301,8 +301,8 @@ static hts_boolean sitemap_fetch_allowed(httrackp *opt, const char *adr,
   if (src == HTS_SITEMAP_SRC_GUESSED &&
       hts_robots_forbids(opt, adr, fil, (jok != 0) ? HTS_TRUE : HTS_FALSE,
                          refused)) {
-    hts_log_print(opt, LOG_NOTICE, "Sitemap: robots.txt forbids %s%s", adr,
-                  fil);
+    hts_log_print(opt, LOG_NOTICE, "Sitemap: robots.txt forbids %s%s",
+                  adr_nologin(opt, adr), fil);
     return HTS_FALSE;
   }
   return HTS_TRUE;
@@ -319,8 +319,8 @@ static hts_boolean sitemap_queue_(httrackp *opt, const char *adr,
   if (st == NULL)
     return HTS_FALSE;
   if (st->ndocs >= HTS_SITEMAP_MAX_DOCS || level > HTS_SITEMAP_MAX_LEVEL) {
-    hts_log_print(opt, LOG_WARNING, "Sitemap: cap reached, skipping %s%s", adr,
-                  fil);
+    hts_log_print(opt, LOG_WARNING, "Sitemap: cap reached, skipping %s%s",
+                  adr_nologin(opt, adr), fil);
     return HTS_FALSE;
   }
   if (strlen(adr) >= sizeof(d->adr) || strlen(fil) >= sizeof(d->fil))
@@ -351,7 +351,8 @@ static hts_boolean sitemap_queue_(httrackp *opt, const char *adr,
   heap_top()->retry = opt->retry;
   heap_top()->premier = heap_top_index();
   heap_top()->precedent = heap_top_index();
-  hts_log_print(opt, LOG_INFO, "Sitemap: queued %s%s", adr, fil);
+  hts_log_print(opt, LOG_INFO, "Sitemap: queued %s%s", adr_nologin(opt, adr),
+                fil);
   return HTS_TRUE;
 }
 
@@ -370,8 +371,8 @@ void hts_sitemap_redirect(httrackp *opt, const char *adr, const char *fil,
   d->done = HTS_TRUE; /* the body lives at the target now */
   /* The engine already queued the target link, so only the marking moves. */
   (void) sitemap_queue_(opt, newadr, newfil, d->level, d->src, HTS_FALSE);
-  hts_log_print(opt, LOG_NOTICE, "Sitemap: %s%s redirects to %s%s", adr, fil,
-                newadr, newfil);
+  hts_log_print(opt, LOG_NOTICE, "Sitemap: %s%s redirects to %s%s",
+                adr_nologin(opt, adr), fil, adr_nologin(opt, newadr), newfil);
 }
 
 void hts_sitemap_seed(httrackp *opt, const char *starturl) {
@@ -384,7 +385,8 @@ void hts_sitemap_seed(httrackp *opt, const char *starturl) {
     } else {
       strcpybuff(url, StringBuff(opt->sitemap_url));
       if (strstr(url, ":/") == NULL)
-        hts_log_print(opt, LOG_ERROR, "Sitemap URL must be absolute: %s", url);
+        hts_log_print(opt, LOG_ERROR, "Sitemap URL must be absolute: %s",
+                      url_nologin(opt, url));
       else if (ident_url_absolute(url, &af) >= 0)
         (void) sitemap_queue(opt, af.adr, af.fil, 0, HTS_SITEMAP_SRC_USER);
     }
@@ -458,7 +460,7 @@ void hts_sitemap_robots(httrackp *opt, const char *adr, const char *sitemaps) {
       queued++;
   }
   hts_log_print(opt, LOG_NOTICE, "Sitemap: %d sitemap(s) queued for %s", queued,
-                adr);
+                adr_nologin(opt, adr));
 }
 
 hts_boolean hts_sitemap_pending(httrackp *opt, const char *adr,
@@ -522,8 +524,8 @@ static hts_boolean sitemap_seed_child(void *arg, const char *url) {
     return HTS_TRUE;
   if (!strfield2(af.adr, c->adr)) {
     hts_log_print(c->opt, LOG_WARNING,
-                  "Sitemap: ignoring off-host child sitemap %s%s", af.adr,
-                  af.fil);
+                  "Sitemap: ignoring off-host child sitemap %s%s",
+                  adr_nologin(c->opt, af.adr), af.fil);
     return HTS_TRUE;
   }
   if (sitemap_queue(c->opt, af.adr, af.fil, c->level + 1,
@@ -574,17 +576,17 @@ void hts_sitemap_ingest(httrackp *opt, htsmoduleStruct *str, const char *adr,
                        sitemap_seed_any, &ctx);
   heap(anchor)->depth = saved_depth;
   if (n < 0) {
-    hts_log_print(opt, LOG_ERROR, "Sitemap: could not decompress %s%s", adr,
-                  fil);
+    hts_log_print(opt, LOG_ERROR, "Sitemap: could not decompress %s%s",
+                  adr_nologin(opt, adr), fil);
     return;
   }
   if (ctx.is_index)
     hts_log_print(opt, LOG_NOTICE,
                   "Sitemap: %d of %d child sitemap(s) listed by %s%s",
-                  ctx.accepted, n, adr, fil);
+                  ctx.accepted, n, adr_nologin(opt, adr), fil);
   else
     hts_log_print(opt, LOG_NOTICE, "Sitemap: %d of %d URL(s) added from %s%s",
-                  ctx.accepted, n, adr, fil);
+                  ctx.accepted, n, adr_nologin(opt, adr), fil);
 }
 
 void hts_sitemap_free(httrackp *opt) {
diff --git a/src/htsstats.h b/src/htsstats.h
index d1184e596..ed91681aa 100644
--- a/src/htsstats.h
+++ b/src/htsstats.h
@@ -33,7 +33,9 @@ Please visit our Website: http://www.httrack.com
 #ifndef HTS_STATS_DEFH
 #define HTS_STATS_DEFH
 
+#include <string.h>
 #include "htsglobal.h"
+#include "httrack-library.h"
 
 /* One row of the "in progress" display, shared so the CLI (httrack) and the
    web GUI (htsserver) cannot drift apart: each fills its own array. */
@@ -60,4 +62,18 @@ struct t_StatsBuffer {
   int actived; // pour disabled
 };
 
+/* Returns where adr resumes past its login, which the display never shows,
+   and sets *keep to the length of the scheme shown before it. */
+HTS_STATIC const char *stats_skip_login(const char *adr, size_t *keep) {
+  const char *const host = jump_identification_const(adr);
+  const char *const sep = strstr(adr, "://");
+
+  if (host == adr || host[-1] != '@') {
+    *keep = 0;
+    return adr;
+  }
+  *keep = sep != NULL && sep < host ? (size_t) (sep + 3 - adr) : 0;
+  return host;
+}
+
 #endif
diff --git a/src/htsweb.c b/src/htsweb.c
index 127611fe9..ecc1a8c60 100644
--- a/src/htsweb.c
+++ b/src/htsweb.c
@@ -875,9 +875,14 @@ int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_back * b
                 //
                 s[0] = '\0';
                 strcpybuff(StatsBuffer[index].url_sav, back[i].url_sav);        // pour cancel
-                if (strcmp(back[i].url_adr, "file://"))
-                  strcatbuff(s, back[i].url_adr);
-                else
+                if (strcmp(back[i].url_adr, "file://")) {
+                  size_t keep;
+                  const char *const host =
+                      stats_skip_login(back[i].url_adr, &keep);
+
+                  strncatbuff(s, back[i].url_adr, keep);
+                  strcatbuff(s, host);
+                } else
                   strcatbuff(s, "localhost");
                 /* url_adr and url_fil are each as wide as s, and this is
                    the progress display: clip rather than abort */
@@ -885,6 +890,7 @@ int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_back * b
                   strlncatbuff(s, "/", sizeof(s), sizeof(s) - 1 - strlen(s));
                 strlncatbuff(s, back[i].url_fil, sizeof(s),
                              sizeof(s) - 1 - strlen(s));
+                hts_hide_secrets(opt, s, sizeof(s));
 
                 StatsBuffer[index].file[0] = '\0';
                 {
diff --git a/src/htswizard.c b/src/htswizard.c
index 4c9d19933..7a1efd984 100644
--- a/src/htswizard.c
+++ b/src/htswizard.c
@@ -409,7 +409,7 @@ void hts_wizard_apply_verdict(httrackp *opt, int n, const char *adr,
     hts_log_print(opt, LOG_WARNING,
                   "(wizard) could not read your answer at %s%s: link refused, "
                   "and the refusal recorded",
-                  adr, fil);
+                  adr_nologin(opt, adr), fil);
     break;
 
   case 5:  /* this directory and below, or the whole host */
@@ -424,7 +424,7 @@ void hts_wizard_apply_verdict(httrackp *opt, int n, const char *adr,
       hts_log_print(opt, LOG_WARNING,
                     "(wizard) unknown answer %d at %s%s, keeping the computed "
                     "verdict",
-                    n, adr, fil);
+                    n, adr_nologin(opt, adr), fil);
       break;
     }
     if (hts_wizard_scope_answer(n) == HTS_TRUE)
@@ -436,7 +436,7 @@ void hts_wizard_apply_verdict(httrackp *opt, int n, const char *adr,
         hts_log_print(opt, LOG_WARNING,
                       "(wizard) %s has no domain above it, answer %d applied "
                       "to the whole host",
-                      adr, n);
+                      adr_nologin(opt, adr), n);
     }
     break;
   }
@@ -486,7 +486,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
   // -------------------- PHASE 0 --------------------
 
   /* Infos */
-  hts_log_print(opt, LOG_DEBUG, "wizard test begins: %s%s", adr, fil);
+  hts_log_print(opt, LOG_DEBUG, "wizard test begins: %s%s",
+                adr_nologin(opt, adr), fil);
 
   /* Already exists? Then, we know that we knew that this link had to be known */
   if (adr[0] != '\0' && fil[0] != '\0' && opt->hash != NULL
@@ -512,8 +513,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
   if ((opt->getmode & HTS_GETMODE_NONHTML) == 0) { // non on ne doit pas
     if (!ishtml(opt, fil)) {                       // non il ne faut pas
       forbidden_url = 1;        // interdire récupération du lien
-      hts_log_print(opt, LOG_DEBUG, "non-html file ignored at %s : %s", adr,
-                    fil);
+      hts_log_print(opt, LOG_DEBUG, "non-html file ignored at %s : %s",
+                    adr_nologin(opt, adr), fil);
     }
   }
 
@@ -523,7 +524,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
         || (heap(ptr)->depth <= 1 && !embedded_triggered)) {
       forbidden_url = 1;        // interdire récupération du lien
       hts_log_print(opt, LOG_DEBUG,
-                    "file from too far level ignored at %s : %s", adr, fil);
+                    "file from too far level ignored at %s : %s",
+                    adr_nologin(opt, adr), fil);
     }
   }
 
@@ -541,9 +543,11 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
                  hts_host_same_alias(hts_host_alias_rules(opt), adr, urladr(),
                                      hts_host_alias_collapse_www(opt));
   if (meme_adresse)
-    hts_log_print(opt, LOG_DEBUG, "Compare addresses: %s=%s", adr, urladr());
+    hts_log_print(opt, LOG_DEBUG, "Compare addresses: %s=%s",
+                  adr_nologin(opt, adr), adr_nologin(opt, urladr()));
   else
-    hts_log_print(opt, LOG_DEBUG, "Compare addresses: %s!=%s", adr, urladr());
+    hts_log_print(opt, LOG_DEBUG, "Compare addresses: %s!=%s",
+                  adr_nologin(opt, adr), adr_nologin(opt, urladr()));
   if (meme_adresse) {           // même adresse 
     {                           // tester interdiction de descendre
       // MODIFIE : en cas de remontée puis de redescente, il se pouvait qu'on ne puisse pas atteindre certains fichiers
@@ -561,8 +565,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
         if (lienrelatif(tempo2, sizeof(tempo2), fil, heap(ptr)->fil) == 0) {
           hts_log_print(opt, LOG_DEBUG,
                         "build relative links to test: %s %s (with %s and %s)",
-                        tempo, tempo2, heap(heap(ptr)->premier)->fil,
-                        heap(ptr)->fil);
+                        url_nologin(opt, tempo), url_nologin(opt, tempo2),
+                        heap(heap(ptr)->premier)->fil, heap(ptr)->fil);
 
           // si vient de primary, ne pas tester lienrelatif avec (car host "différent")
           /*if (heap(heap(ptr)->premier) == 0) {   // vient de primary
@@ -582,7 +586,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
             if (!heap(ptr)->link_import) {     // ne résulte pas d'un 'moved'
               ACCEPT_LINK();
               hts_log_print(opt, LOG_DEBUG, "same level link authorized: %s%s",
-                            adr, fil);
+                            adr_nologin(opt, adr), fil);
             }
           }
           // down
@@ -601,13 +605,13 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
             if ((test1) && (test2)) {   // on ne peut que descendre
               if ((opt->seeker & HTS_SEEKER_DOWN) == 0) {
                 forbidden_url = 1;
-                hts_log_print(opt, LOG_DEBUG, "lower link canceled: %s%s", adr,
-                              fil);
+                hts_log_print(opt, LOG_DEBUG, "lower link canceled: %s%s",
+                              adr_nologin(opt, adr), fil);
               } else {                         // autorisé à priori - NEW
                 if (!heap(ptr)->link_import) { // ne résulte pas d'un 'moved'
                   ACCEPT_LINK();
                   hts_log_print(opt, LOG_DEBUG, "lower link authorized: %s%s",
-                                adr, fil);
+                                adr_nologin(opt, adr), fil);
                 }
               }
             } else if ((test1) || (test2)) {    // on peut descendre pour accéder au lien
@@ -615,7 +619,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
                 if (!heap(ptr)->link_import) { // ne résulte pas d'un 'moved'
                   ACCEPT_LINK();
                   hts_log_print(opt, LOG_DEBUG, "lower link authorized: %s%s",
-                                adr, fil);
+                                adr_nologin(opt, adr), fil);
                 }
               }
             }
@@ -626,13 +630,13 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
             if ((opt->seeker & HTS_SEEKER_UP) == 0) {
               forbidden_url = 1;
               upper_refused = 1;
-              hts_log_print(opt, LOG_DEBUG, "upper link canceled: %s%s", adr,
-                            fil);
+              hts_log_print(opt, LOG_DEBUG, "upper link canceled: %s%s",
+                            adr_nologin(opt, adr), fil);
             } else {                           // autorisé à monter - NEW
               if (!heap(ptr)->link_import) {   // ne résulte pas d'un 'moved'
                 ACCEPT_LINK();
                 hts_log_print(opt, LOG_DEBUG, "upper link authorized: %s%s",
-                              adr, fil);
+                              adr_nologin(opt, adr), fil);
               }
             }
           } else if ((!strncmp(tempo, "../", 3)) || (!strncmp(tempo2, "../", 3))) {     // Possible en montant
@@ -640,7 +644,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
               if (!heap(ptr)->link_import) {   // ne résulte pas d'un 'moved'
                 ACCEPT_LINK();
                 hts_log_print(opt, LOG_DEBUG, "upper link authorized: %s%s",
-                              adr, fil);
+                              adr_nologin(opt, adr), fil);
               }
             } // sinon autorisé en descente
           }
@@ -688,14 +692,14 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           if (!opt->wizard) {                    // mode non wizard
             forbidden_url = 1; // pas même domaine
             hts_log_print(opt, LOG_DEBUG, "foreign domain link canceled: %s%s",
-                          adr, fil);
+                          adr_nologin(opt, adr), fil);
           }
 
         } else {
           if (opt->wizard) {   // mode wizard
             ACCEPT_LINK();     // same domain
             hts_log_print(opt, LOG_DEBUG, "same domain link authorized: %s%s",
-                          adr, fil);
+                          adr_nologin(opt, adr), fil);
           }
         }
 
@@ -715,13 +719,14 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           if (!opt->wizard) {                    // mode non wizard
             forbidden_url = 1; // pas même .xx
             hts_log_print(opt, LOG_DEBUG,
-                          "foreign location link canceled: %s%s", adr, fil);
+                          "foreign location link canceled: %s%s",
+                          adr_nologin(opt, adr), fil);
           }
         } else {
           if (opt->wizard) {   // mode wizard
             ACCEPT_LINK();     // same domain
             hts_log_print(opt, LOG_DEBUG, "same location link authorized: %s%s",
-                          adr, fil);
+                          adr_nologin(opt, adr), fil);
           }
         }
       } else
@@ -745,7 +750,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
     if (!ishtml(opt, fil)) {    // non html
       ACCEPT_LINK();            // authorize
       may_set_prio_to = 1 + 1;  // set prio to 1 (parse but skip urls) if near is the winner
-      hts_log_print(opt, LOG_DEBUG, "near link authorized: %s%s", adr, fil);
+      hts_log_print(opt, LOG_DEBUG, "near link authorized: %s%s",
+                    adr_nologin(opt, adr), fil);
     }
   }
   // -------------------- PHASE 3-BIS --------------------
@@ -755,7 +761,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
     ACCEPT_LINK();              // authorize
     may_set_prio_to = 1 + 1;    // set prio to 1 (parse but skip urls) if near is the winner
     hts_log_print(opt, LOG_DEBUG, "near link authorized (friendly tag): %s%s",
-                  adr, fil);
+                  adr_nologin(opt, adr), fil);
   }
 
   // -------------------- PHASE 4 --------------------
@@ -767,8 +773,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
   if (opt->wizard && !hts_wizard_url_fits(adr, fil)) {
     /* the length, not the path: 2 KB of it is unreadable in a log */
     hts_log_print(opt, LOG_DEBUG,
-                  "(wizard) link too long, forbidden: %s (%d bytes)", adr,
-                  (int) strlen(fil));
+                  "(wizard) link too long, forbidden: %s (%d bytes)",
+                  adr_nologin(opt, adr), (int) strlen(fil));
     REFUSE_LINK();          // URL forbidden
   } else if (opt->wizard) { // le wizard entre en action..
     //
@@ -822,12 +828,14 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
             question = 0;       // résolution auto
             if (question) {
               hts_log_print(opt, LOG_DEBUG,
-                            "(wizard) ambiguous link accepted (external depth): link %s at %s%s",
-                            l, urladr(), urlfil());
+                            "(wizard) ambiguous link accepted (external "
+                            "depth): link %s at %s%s",
+                            l, adr_nologin(opt, urladr()), urlfil());
             } else {
               hts_log_print(opt, LOG_DEBUG,
-                            "(wizard) forced to accept link (external depth): link %s at %s%s",
-                            l, urladr(), urlfil());
+                            "(wizard) forced to accept link (external depth): "
+                            "link %s at %s%s",
+                            l, adr_nologin(opt, urladr()), urlfil());
             }
 
           }
@@ -852,16 +860,18 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           question = 0;         // ne pas poser de question, autorisé
           ACCEPT_LINK();        // URL authorized
           may_set_prio_to = 0;  // clear may-set flag
-          hts_log_print(opt, LOG_DEBUG,
-                        "(wizard) explicit authorized (%s) link: link %s at %s%s",
-                        mdepth, l, urladr(), urlfil());
+          hts_log_print(
+              opt, LOG_DEBUG,
+              "(wizard) explicit authorized (%s) link: link %s at %s%s", mdepth,
+              l, adr_nologin(opt, urladr()), urlfil());
         } else if (jok == -1) { // forbidden
           filters_answer = 1;   // décision prise par les filtres
           question = 0;         // ne pas poser de question:
           REFUSE_LINK();        // URL forbidden
-          hts_log_print(opt, LOG_DEBUG,
-                        "(wizard) explicit forbidden (%s) link: link %s at %s%s",
-                        mdepth, l, urladr(), urlfil());
+          hts_log_print(
+              opt, LOG_DEBUG,
+              "(wizard) explicit forbidden (%s) link: link %s at %s%s", mdepth,
+              l, adr_nologin(opt, urladr()), urlfil());
         }                       // sinon on touche à rien
       }
     }
@@ -876,7 +886,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           force_mirror = 5;     // mirror (5)
           hts_log_print(opt, LOG_DEBUG,
                         "(wizard) explicit mirror link: link %s at %s%s", l,
-                        urladr(), urlfil());
+                        adr_nologin(opt, urladr()), urlfil());
         }
       }
     }
@@ -888,7 +898,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
         REFUSE_LINK();
         hts_log_print(opt, LOG_DEBUG,
                       "(wizard) ambiguous forbidden link: link %s at %s%s", l,
-                      urladr(), urlfil());
+                      adr_nologin(opt, urladr()), urlfil());
       }
     }
     // vérifier robots.txt
@@ -904,14 +914,14 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           hts_log_print(
               opt, LOG_DEBUG,
               "Warning link followed against robots.txt: link %s at %s%s", l,
-              adr, fil);
+              adr_nologin(opt, adr), fil);
         }
       } else {
         REFUSE_LINK();
         question = 0;
         hts_log_print(opt, LOG_DEBUG,
-                      "(robots.txt) forbidden link: link %s at %s%s", l, adr,
-                      fil);
+                      "(robots.txt) forbidden link: link %s at %s%s", l,
+                      adr_nologin(opt, adr), fil);
       }
     }
 
@@ -919,11 +929,11 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
       if (!forbidden_url) {
         hts_log_print(opt, LOG_DEBUG,
                       "(wizard) shared foreign domain link: link %s at %s%s", l,
-                      urladr(), urlfil());
+                      adr_nologin(opt, urladr()), urlfil());
       } else {
         hts_log_print(opt, LOG_DEBUG,
                       "(wizard) cancelled foreign domain link: link %s at %s%s",
-                      l, urladr(), urlfil());
+                      l, adr_nologin(opt, urladr()), urlfil());
       }
 #if BDEBUG==3
       printf("at %s in %s, wizard says: url %s ", urladr(), urlfil(), l);
@@ -1009,7 +1019,7 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
           }
           hts_log_print(
               opt, LOG_NOTICE, "(wizard) answer '%s' (n=%d) for %s%s: %s%s%s",
-              s, n, adr, fil,
+              s, n, adr_nologin(opt, adr), fil,
               forbidden_url == 1   ? "forbidden"
               : forbidden_url == 0 ? "allowed"
                                    : "no verdict",
@@ -1029,7 +1039,8 @@ static int hts_acceptlink_(httrackp *opt, int ptr, const char *adr,
         if (strfield(adr, "ftp://") == 0) {                   // PAS ftp!
           forbidden_url = 1;    // oui oui toujours interdit (note: sert à rien car ==1 mais c pour comprendre)
           *just_test_it = 1;    // mais on teste
-          hts_log_print(opt, LOG_DEBUG, "Testing link %s%s", adr, fil);
+          hts_log_print(opt, LOG_DEBUG, "Testing link %s%s",
+                        adr_nologin(opt, adr), fil);
         }
       }
     }
@@ -1070,12 +1081,12 @@ int hts_acceptmime(httrackp * opt, int ptr,
       forbidden_url = 0;        // URL autorisée
       hts_log_print(opt, LOG_DEBUG,
                     "(wizard) explicit authorized (%s) link %s%s: mime '%s'",
-                    mdepth, adr, fil, mime);
+                    mdepth, adr_nologin(opt, adr), fil, mime);
     } else if (jok == -1) {     // forbidden
       forbidden_url = 1;        // URL interdite
       hts_log_print(opt, LOG_DEBUG,
                     "(wizard) explicit forbidden (%s) link %s%s: mime '%s'",
-                    mdepth, adr, fil, mime);
+                    mdepth, adr_nologin(opt, adr), fil, mime);
     }                           // sinon on touche à rien
   }
   /* userdef test */
@@ -1151,13 +1162,14 @@ int hts_testlinksize(httrackp * opt, const char *adr, const char *fil, LLint siz
       // log
       if (jok == 1) {
         hts_log_print(opt, LOG_DEBUG,
-                      "File confirmed (size test): %s%s (" LLintP ")", adr, fil,
-                      (LLint) (size));
+                      "File confirmed (size test): %s%s (" LLintP ")",
+                      adr_nologin(opt, adr), fil, (LLint) (size));
       } else if (jok == -1) {
         if (size_flag) {        /* interdit à cause de la taille */
           hts_log_print(opt, LOG_DEBUG,
                         "File cancelled due to its size: %s%s (" LLintP
-                        ", limit: " LLintP ")", adr, fil, (LLint) (size),
+                        ", limit: " LLintP ")",
+                        adr_nologin(opt, adr), fil, (LLint) (size),
                         (LLint) (sz));
         } else {
           jok = 1;
diff --git a/src/httrack-library.h b/src/httrack-library.h
index b22b29633..ad842ea29 100644
--- a/src/httrack-library.h
+++ b/src/httrack-library.h
@@ -467,6 +467,12 @@ HTSEXT_API const char *hts_accept_preset(const char *browser, const char *kind);
     lives. @p opt must not be NULL. */
 HTSEXT_API char *hts_errmsg(httrackp *opt);
 
+/** Replace in place each password or token @p opt has seen with ***, so a
+    front end can show a URL it built itself. @p s is NUL-terminated in a
+    buffer of @p size bytes, and the result is clipped to it. Thread-safe.
+    A NULL @p opt does nothing, and out of memory empties @p s. */
+HTSEXT_API void hts_hide_secrets(httrackp *opt, char *s, size_t size);
+
 /** Get or set the transfer-pause flag. A second argument >= 0 sets it, where
     nonzero means paused, and a negative one only queries. @return the flag as
     it now stands. */
diff --git a/src/httrack.c b/src/httrack.c
index 3930e8c5a..f46ec269e 100644
--- a/src/httrack.c
+++ b/src/httrack.c
@@ -658,13 +658,19 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
                 //
                 s[0] = '\0';
                 strcpybuff(StatsBuffer[index].url_sav, back[i].url_sav);        // pour cancel
-                if (strcmp(back[i].url_adr, "file://"))
-                  strcatbuff(s, back[i].url_adr);
-                else
+                if (strcmp(back[i].url_adr, "file://")) {
+                  size_t keep;
+                  const char *const host =
+                      stats_skip_login(back[i].url_adr, &keep);
+
+                  strncatbuff(s, back[i].url_adr, keep);
+                  strcatbuff(s, host);
+                } else
                   strcatbuff(s, "localhost");
                 if (back[i].url_fil[0] != '/')
                   strcatbuff(s, "/");
                 strcatbuff(s, back[i].url_fil);
+                hts_hide_secrets(opt, s, sizeof(s));
 
                 StatsBuffer[index].file[0] = '\0';
                 {
diff --git a/tests/657_local-header-log-redact.test b/tests/657_local-header-log-redact.test
new file mode 100644
index 000000000..a0735abf1
--- /dev/null
+++ b/tests/657_local-header-log-redact.test
@@ -0,0 +1,284 @@
+#!/bin/bash
+#
+# The -%H log (hts-ioinfo.txt) hides the value of every header and FTP command
+# that carries a login, while the wire still carries it.
+
+set -euo pipefail
+
+# shellcheck source=tests/testlib.sh
+. "${0%"${0##*/}"}./testlib.sh"
+
+require_httrack
+
+TAB=$'\t'
+CR=$'\r'
+
+python=$(find_python) || skip "python3 missing"
+
+server=$(nativepath "$top_srcdir/tests/header-injection-server.py")
+tmpdir=$(mktemp -d)
+serverpid=
+wire=$tmpdir/wire
+
+cleanup() {
+    stop_server "$serverpid"
+    rm -rf "$tmpdir"
+}
+cleanup_push cleanup
+
+"$python" "$server" "$(nativepath "$wire")" >"$tmpdir/server.out" 2>"$tmpdir/server.err" &
+serverpid=$!
+port=$(discover_server_port "$tmpdir/server.out" "$serverpid") || exit 1
+
+crawl() { # crawl TAG URL [extra httrack args...]
+    local tag=$1 url=$2 rc=0
+    shift 2
+    mkdir -p "$tmpdir/$tag"
+    if test -e "$tmpdir/cookies.txt"; then
+        cp "$tmpdir/cookies.txt" "$tmpdir/$tag/"
+    fi
+    run_with_timeout 90 httrack "$url" -O "$tmpdir/$tag" -c1 --robots=0 \
+        --retries=0 --quiet -%v0 -%H "$@" >>"$tmpdir/log" 2>&1 || rc=$?
+    test "$rc" -eq 0 || fail "$tag: the crawl exited $rc"
+    cat "$tmpdir/$tag/hts-ioinfo.txt" >>"$tmpdir/ioinfo"
+}
+
+printf '127.0.0.1\tFALSE\t/\tFALSE\t2999999999\tjarsess\tJARSECRET\n' \
+    >"$tmpdir/cookies.txt"
+# -%X drops the blank before the colon (#1996), so only a response keeps one
+crawl jar "http://urluser:URLSECRET@127.0.0.1:$port/setcookie.html" \
+    -%X "Proxy-Authorization : Bearer PROXYSECRET"
+rm "$tmpdir/cookies.txt"
+crawl box "http://127.0.0.1:$port/plain.html" -%X "authorization: Bearer AUTHSECRET" \
+    -%X "Cookie2: VISIBLE3"
+
+basic=$(printf urluser:URLSECRET | base64)
+log=$(<"$tmpdir/ioinfo")
+sent=$(<"$wire")
+# a field whose name only starts like a hidden one stays in clear
+for line in ">>> X-Visible: shown" ">>> X-Cookie-Id: VISIBLE2" \
+    "<<< Cookie2: VISIBLE3" ">>> Authorization-Info: VISIBLE4"; do
+    grep -qxF "$line$CR" <<<"$log" || fail "no '$line' in hts-ioinfo.txt: $log"
+done
+# the server sent these, so only the request secrets are on the wire
+for secret in JARSECRET PROXYSECRET AUTHSECRET "$basic" "srvsess=SETCOOKIESECRET"; do
+    grep -qF "$secret" <<<"$sent" || fail "$secret never reached the server"
+done
+for secret in JARSECRET PROXYSECRET AUTHSECRET "$basic" SETCOOKIESECRET \
+    SPACEDSECRET FOLDEDSECRET; do
+    if grep -qF "$secret" <<<"$log"; then
+        fail "$secret is in hts-ioinfo.txt: $(grep -F "$secret" <<<"$log")"
+    fi
+done
+for line in "<<< Authorization: <redacted, $((${#basic} + 6)) bytes>" \
+    "<<< Proxy-Authorization: <redacted, 18 bytes>" \
+    "<<< Cookie: <redacted, 17 bytes>" \
+    "<<< authorization: <redacted, 17 bytes>" \
+    ">>> Set-Cookie: <redacted, 31 bytes>" \
+    ">>> set-cookie$TAB: <redacted, 20 bytes>" \
+    ">>> $TAB<redacted, 19 bytes>"; do
+    grep -qF "$line" <<<"$log" || fail "no '$line' in hts-ioinfo.txt: $log"
+done
+ok "HTTP login headers are redacted in the log and sent in full"
+
+# A cookie the loader refuses is logged by its name, never by its value.
+printf 'dup=1; dup=DUPSECRET; =NONAMESECRET\n' >"$tmpdir/flat.txt"
+crawl flat "http://127.0.0.1:$port/plain.html" --cookies-file "$tmpdir/flat.txt"
+printf 'ok=1; BARESECRET\n' >"$tmpdir/bare.txt"
+crawl bare "http://127.0.0.1:$port/plain.html" --cookies-file "$tmpdir/bare.txt"
+printf '%s\n' "#HTTPOnly_127.0.0.1${TAB}FALSE$TAB/${TAB}FALSE${TAB}0${TAB}comname${TAB}TABSECRET" \
+    "# SID=EQSECRET" "#TOKSECRET" >"$tmpdir/jar.txt"
+crawl netscape "http://127.0.0.1:$port/plain.html" --cookies-file "$tmpdir/jar.txt"
+for tag in flat bare netscape; do
+    log=$(<"$tmpdir/$tag/hts-log.txt")
+    for secret in DUPSECRET NONAMESECRET BARESECRET TABSECRET EQSECRET TOKSECRET; do
+        if grep -qF "$secret" <<<"$log"; then
+            fail "$secret is in hts-log.txt: $(grep -F "$secret" <<<"$log")"
+        fi
+    done
+done
+grep -qF "ignoring a repeated 'dup'" "$tmpdir/flat/hts-log.txt" || fail "no repeated 'dup'"
+grep -qF "a cookie with no name" "$tmpdir/flat/hts-log.txt" || fail "no nameless =value"
+grep -qF "a cookie with no name" "$tmpdir/bare/hts-log.txt" || fail "no bare value"
+for n in 1 2 3; do
+    grep -qF "unknown comment on line $n of $tmpdir/jar.txt" "$tmpdir/netscape/hts-log.txt" ||
+        fail "no unknown comment on line $n: $(<"$tmpdir/netscape/hts-log.txt")"
+done
+ok "a refused cookie is logged without its value"
+
+# A password in a URL, a proxy or a -%X header never reaches hts-log.txt.
+crawl proxy "http://127.0.0.1:$port/plain.html" -P "puser:PPWSECRET@127.0.0.1:$port"
+grep -qF "Proxy-Authorization: Basic $(printf puser:PPWSECRET | base64)" "$wire" ||
+    fail "the proxy password never reached the proxy"
+log=$(cat "$tmpdir/jar/hts-log.txt" "$tmpdir/box/hts-log.txt" "$tmpdir/proxy/hts-log.txt")
+for secret in URLSECRET PPWSECRET AUTHSECRET PROXYSECRET; do
+    if grep -qF "$secret" <<<"$log"; then
+        fail "$secret is in hts-log.txt: $(grep -F "$secret" <<<"$log")"
+    fi
+done
+for line in "urluser:***@127.0.0.1:$port/setcookie.html" "puser:***@127.0.0.1:$port" \
+    "authorization: <redacted, 17 bytes>"; do
+    grep -qF "$line" <<<"$log" || fail "no '$line' in hts-log.txt: $log"
+done
+ok "hts-log.txt masks the passwords of URLs, proxies and -%X headers"
+
+# a -%X Cookie value is no token, so a path holding it stays readable
+crawl cookieword "http://127.0.0.1:$port/privacy/accepted-terms.html" \
+    -%X "Cookie: consent=accepted"
+grep -qF "/privacy/accepted-terms.html -O" "$tmpdir/cookieword/hts-log.txt" ||
+    fail "a Cookie value masked a path: $(<"$tmpdir/cookieword/hts-log.txt")"
+
+out=$(httrack -#test=maskpw) || fail "httrack -#test=maskpw exited non-zero: $out"
+test "$out" = "maskpw self-test: OK" || fail "expected 'maskpw self-test: OK', got: $out"
+out=$(httrack -#test=secrets) || fail "httrack -#test=secrets exited non-zero: $out"
+test "$out" = "secrets self-test: OK" || fail "expected 'secrets self-test: OK', got: $out"
+# a header token is hidden anywhere, a password only as a login
+crawl token "http://u:TOKENPWQ1@127.0.0.1:$port/token.html" -z -Z -r2 \
+    -%X "Authorization: Bearer HDRTOKQ3"
+crawl word "http://u:html@127.0.0.1:$port/hop.html" -z -Z -r2
+log=$(cat "$tmpdir/token/hts-log.txt" "$tmpdir/token/hts-ioinfo.txt")
+for q in k=TOKENPWQ1 l=LINKTOKQ2 h=HDRTOKQ3; do
+    grep -qF "GET /leaf.html?$q HTTP/1." "$wire" || fail "$q never reached the server"
+done
+if grep -qF HDRTOKQ3 <<<"$log"; then
+    fail "HDRTOKQ3 is in the log: $(grep -F HDRTOKQ3 <<<"$log")"
+fi
+for line in "/leaf.html?h=***" "<<< GET /leaf.html?h=*** HTTP/1." \
+    "/leaf.html?k=TOKENPWQ1" "/leaf.html?l=LINKTOKQ2" "luser:***@127.0.0.1:$port/leaf.html"; do
+    grep -qF -- "$line" <<<"$log" || fail "no '$line' in the log: $log"
+done
+log=$(<"$tmpdir/word/hts-log.txt")
+for line in "u:***@127.0.0.1:$port/hop.html" "127.0.0.1:$port/plain.html"; do
+    grep -qF -- "$line" <<<"$log" || fail "no '$line' in hts-log.txt: $log"
+done
+if grep -qF "u:html@" <<<"$log"; then
+    fail "the password html is in hts-log.txt"
+fi
+ok "the log hides a header token anywhere, and a password only as a login"
+# planted.html links with a password in every form the engine reads one
+# not quiet, so stdout and stderr carry the start URLs too
+mkdir -p "$tmpdir/planted"
+run_with_timeout 90 httrack "http://suser:STARTPWA@127.0.0.1:$port/planted.html" \
+    "suser:STARTPWB@127.0.0.1:$port/hop.html" "http://STARTPWT@127.0.0.1:$port/plain.html" \
+    -O "$tmpdir/planted" -c4 -s2 \
+    --sitemap-url "http://luser:LINKPWS@127.0.0.1:$port/sitemap.xml" --retries=0 -%v1 \
+    -%H -z -Z -r4 -T5 "+*" "-*:KEEPFILTER@*" -%X "X-Note: a:KEEPHEADER@c/d" \
+    </dev/null >"$tmpdir/planted/stdout.txt" 2>&1 || fail "planted: the crawl failed"
+crawl planted-proxy "http://127.0.0.1:$port/planted.html" -P "puser:PROXYPW@127.0.0.1:$port" \
+    -z -Z -r4 -T5 "+*" -%R "http://ruser:LINKPWREF@127.0.0.1:$port/"
+crawl planted-ftp "ftp://suser:STARTPWF@127.0.0.1:$port/f.txt" -P "puser:PROXYPW@127.0.0.1:$port"
+log=$(<"$tmpdir/planted/hts-log.txt")
+for line in "at link luser:***@127.0.0.1:1/l8.html (from suser:***@127.0.0.1:$port/planted.html)" \
+    "link detected in javascript: http://luser:***@127.0.0.1:" \
+    "is ready, skipping: luser:***@127.0.0.1:$port/i.gif" \
+    "Sitemap: queued luser:***@127.0.0.1:$port/sitemap.xml" \
+    "robots.txt added at suser:***@127.0.0.1:$port" \
+    "at http://suser:***@127.0.0.1:$port/planted.html suser:***@127.0.0.1:$port/hop.html" \
+    "data attribute is no URL: http://u:***@127.0.0.1:$port/{w}.jpg" \
+    "link detected in html (tag): mms://luser:***@127.0.0.1:$port/m.asf" \
+    "link detected in html (tag): gopher://luser:***@127.0.0.1:$port/g" \
+    "link detected in html (tag):   gopher://luser:***@127.0.0.1:$port/g2" \
+    "build relative links to test: x-y.z+w://luser:***@h.example/a" \
+    " http://***@127.0.0.1:$port/plain.html" \
+    " -*:KEEPFILTER@* -%X \"X-Note: a:KEEPHEADER@c/d\" "; do
+    grep -qF -- "$line" <<<"$log" || fail "no '$line' in hts-log.txt: $log"
+done
+grep -qF ">>> Location: http://ruser:***@127.0.0.1:$port/hop.html" "$tmpdir/planted/hts-ioinfo.txt" ||
+    fail "no masked Location in hts-ioinfo.txt"
+# the page keeps a link the engine cannot fetch as it is, but the log must not
+grep -qF SCHEMEPWM "$tmpdir/planted/127.0.0.1_$port/planted.html" || fail "no mms:// link in the mirror"
+if grep -qF SCHEMEPW <<<"$log"; then
+    fail "an mms:// or gopher:// password is in hts-log.txt: $(grep -F SCHEMEPW <<<"$log")"
+fi
+# the page keeps the data-src value, which is no link, but the log must not
+grep -qF DATAPW "$tmpdir/planted/127.0.0.1_$port/planted.html" || fail "no data-src in the mirror"
+if grep -qF DATAPW <<<"$log"; then
+    fail "the data-src password is in hts-log.txt: $(grep -F DATAPW <<<"$log")"
+fi
+grep -qF "<<< Referer: http://ruser:***@127.0.0.1:$port/" "$tmpdir/planted-proxy/hts-ioinfo.txt" ||
+    fail "no masked -%R Referer in hts-ioinfo.txt"
+grep -qF "<<< GET ftp://suser:***@127.0.0.1:$port/f.txt HTTP/1." "$tmpdir/planted-ftp/hts-ioinfo.txt" ||
+    fail "no masked proxied ftp:// request line in hts-ioinfo.txt"
+stdout=$(<"$tmpdir/planted/stdout.txt")
+for line in "mirroring http://suser:***@127.0.0.1:$port/planted.html" \
+    "suser:***@127.0.0.1:$port/planted.html ("; do
+    grep -qF "$line" <<<"$stdout" || fail "no '$line' on stdout: $stdout"
+done
+grep -qF "STARTPWA" "$tmpdir/planted/hts-cache/doit.log" || fail "the grep below cannot see a password"
+# doit.log, new.txt and new.zip keep the URLs that --update needs
+leaks=$(find "$tmpdir/planted" "$tmpdir/planted-proxy" "$tmpdir/planted-ftp" -type f ! -name doit.log \
+    ! -name new.txt ! -name new.zip -exec grep -aoE "(STARTPW|LINKPW|PROXYPW)[A-Z0-9]*" {} + || true)
+test -z "$leaks" || fail "a password is in the project: $leaks"
+ok "no project file holds a URL or proxy password"
+
+# The messages about arguments and options mask them too.
+printf 'http://u:LONGPW@127.0.0.1/%s\n' "$(repeat_chars 2100 a)" >"$tmpdir/long.txt"
+out=$(httrack -O "$tmpdir/why" -q --why "http://u:WHYPW@127.0.0.1/x" -%S "$tmpdir/long.txt" \
+    "-*x*" 2>&1) || fail "--why exited $?: $out"
+printf '"http://u:QUOTEPWA@127.0.0.1:%s/plain.html"\n"u:QUOTEPWB@127.0.0.1:%s/plain.html"\n' \
+    "$port" "$port" >"$tmpdir/list.txt"
+crawl opts "http://127.0.0.1:$port/plain.html" -%L "$tmpdir/list.txt" \
+    -%X "Authorization: Basic AUTHPWA" -%X "Authorization: Basic AUTHPWB" \
+    -%X "Authorization Basic MALPWA" -%X "proxy-authorization MALPWB"
+rc=0
+httrack "http://127.0.0.1:$port/plain.html" -O "$tmpdir/alias" \
+    --host-alias "http://u:ALIASPW@a.example/x=b.example" >>"$tmpdir/log" 2>&1 || rc=$?
+test "$rc" -ne 0 || fail "a host-alias rule with a path was accepted"
+rc=0
+httrack "\"http://u:QSTARTPW@127.0.0.1:$port/plain.html\"" -O "$tmpdir/quoted" \
+    >>"$tmpdir/log" 2>&1 || rc=$?
+test "$rc" -ne 0 || fail "a quoted start URL was accepted"
+log="$out
+$(cat "$tmpdir/log" "$tmpdir/why/hts-log.txt" "$tmpdir/opts/hts-log.txt")"
+for line in "URL longer than 2047 bytes, ignored: http://u:***@127.0.0.1/aaa" \
+    "http://u:***@127.0.0.1/x: rejected by rule #1 (-*x*)" " -%Y http://u:***@127.0.0.1/x " \
+    "line 1: \"http://u:***@127.0.0.1:$port/plain.html\" is quoted, ignored" \
+    "line 2: \"u:***@127.0.0.1:$port/plain.html\" is quoted, ignored" \
+    "Rejected: http://u:***@a.example/x=b.example" \
+    " -%X \"Authorization <redacted, 12 bytes>\" " \
+    "Argument refused: \"http://u:***@127.0.0.1:$port/plain.html\" is quoted"; do
+    grep -qF -- "$line" <<<"$log" || fail "no '$line' in the messages: $log"
+done
+grep -qxF "warning: -%X header replaces an earlier one: Authorization: <redacted, 13 bytes>" \
+    "$tmpdir/log" || fail "no redacted -%X warning: $(<"$tmpdir/log")"
+for line in "Authorization <redacted, 12 bytes>" "proxy-authorization <redacted, 6 bytes>"; do
+    grep -qxF "warning: -%X malformed header ignored: $line" "$tmpdir/log" ||
+        fail "no redacted '$line' warning: $(<"$tmpdir/log")"
+done
+if grep -E "(LONG|WHY|QUOTE|AUTH|QSTART|MAL|ALIAS)PW" <<<"$log"; then
+    fail "a password is in the messages about arguments"
+fi
+# the progress display draws only on a terminal
+if "$python" -c 'import pty' 2>/dev/null; then
+    mkdir -p "$tmpdir/vt"
+    run_with_timeout 90 "$python" -c 'import pty, sys; pty.spawn(sys.argv[1:])' \
+        httrack "http://suser:VTPW@127.0.0.1:$port/planted.html" -O "$tmpdir/vt" -c4 \
+        --retries=0 -%v -z -r3 -T5 </dev/null >"$tmpdir/vt.out" 2>&1 ||
+        fail "the -%v crawl failed: $(<"$tmpdir/vt.out")"
+    grep -qF "127.0.0.1:$port/slow.html" "$tmpdir/vt.out" || fail "no -%v display: $(<"$tmpdir/vt.out")"
+    if grep -aoE "(VTPW|LINKPW)[A-Z0-9]*" "$tmpdir/vt.out"; then
+        fail "a password is in the -%v display"
+    fi
+fi
+ok "the messages about arguments and the progress display mask passwords"
+
+root="$tmpdir/root"
+cmds="$tmpdir/cmds"
+mkdir -p "$root"
+printf 'body\n' >"$root/f.txt"
+ftp_server_start --root "$root" --require-pass --log "$(nativepath "$cmds")"
+: >"$tmpdir/ioinfo"
+crawl ftp "ftp://ftpuser:FTPSECRET@127.0.0.1:${FTP_PORT}/f.txt"
+grep -qxF "PASS FTPSECRET" "$cmds" || fail "the FTP password never reached the server"
+log=$(<"$tmpdir/ioinfo")
+if grep -qF FTPSECRET <<<"$log"; then
+    fail "the FTP password is in hts-ioinfo.txt"
+fi
+grep -qF -- "---> PASS <redacted, 9 bytes>" <<<"$log" || fail "no redacted PASS: $log"
+# the user name alone is no secret, so it stays
+grep -qF -- "---> USER ftpuser" <<<"$log" || fail "no USER in clear: $log"
+if grep -qF FTPSECRET "$tmpdir/ftp/hts-log.txt"; then
+    fail "the FTP password is in hts-log.txt"
+fi
+grep -qF "ftpuser:***@" "$tmpdir/ftp/hts-log.txt" || fail "no masked FTP URL in hts-log.txt"
+ok "the FTP password is redacted in the log and sent in full"
diff --git a/tests/660_lint-log-logins.test b/tests/660_lint-log-logins.test
new file mode 100644
index 000000000..06a2ca12f
--- /dev/null
+++ b/tests/660_lint-log-logins.test
@@ -0,0 +1,109 @@
+#!/bin/bash
+#
+# Check that no log call prints an engine address with its password.
+
+set -euo pipefail
+
+# shellcheck source=tests/testlib.sh
+. "${0%"${0##*/}"}./testlib.sh"
+
+python=$(find_python) || skip "no python3 to run the lint"
+checker="${testdir}/check-log-logins.py"
+src="${top_srcdir}/src"
+
+work=$(mktemp -d "${TMPDIR:-/tmp}/log_logins.XXXXXX") || fail "no tmpdir"
+cleanup_push rm -rf "$work"
+
+lint() { "$python" "$checker" "$@" 2>"$work/lint.err"; }
+
+files=()
+for f in "$src"/*.c; do
+    case "$f" in
+    *_selftest.c) ;;
+    *) files+=("$f") ;;
+    esac
+done
+test "${#files[@]}" -ge 40 || fail "the lint found only ${#files[@]} files to scan"
+out=$(lint "${files[@]}") || fail_dump "a log call prints an address raw:
+$out" "$work/lint.err"
+grep -qx "${#files[@]} files, 0 hits" "$work/lint.err" ||
+    fail_dump "the lint did not scan every file" "$work/lint.err"
+
+# Mutant: one wrapped address put back raw.
+sed 's/? adr_nologin(opt, urladr()) :/? (urladr()) :/' "$src/htscore.c" >"$work/htscore.c"
+cmp -s "$src/htscore.c" "$work/htscore.c" && fail "the htscore.c mutant changed nothing"
+lint "$work/htscore.c" >"$work/mut.out" && fail "the lint passed a raw urladr()"
+grep -q 'is ready, skipping' "$work/mut.out" ||
+    fail "the mutant was not reported: $(<"$work/mut.out")"
+
+# Mutants: a raw address into hts-ioinfo.txt, and a raw lien.
+sed '/"\[%d\] request for %s%s:/{n;s/jump_identification_const(adr)/adr/;}' \
+    "$src/htslib.c" >"$work/htslib.c"
+cmp -s "$src/htslib.c" "$work/htslib.c" && fail "the htslib.c mutant changed nothing"
+lint "$work/htslib.c" >"$work/mut.out" && fail "the lint passed a raw adr to ioinfo"
+grep -q 'request for' "$work/mut.out" ||
+    fail "the ioinfo mutant was not reported: $(<"$work/mut.out")"
+sed '/"link detected in html (tag): %s",/{n;s/url_nologin(opt, lien)/lien/;}' \
+    "$src/htsparse.c" >"$work/htsparse.c"
+cmp -s "$src/htsparse.c" "$work/htsparse.c" && fail "the htsparse.c mutant changed nothing"
+lint "$work/htsparse.c" >"$work/mut.out" && fail "the lint passed a raw lien"
+grep -q 'link detected in html' "$work/mut.out" ||
+    fail "the lien mutant was not reported: $(<"$work/mut.out")"
+
+# Mutants: a raw --why URL, and a raw lien through puts().
+sed 's/adr_nologin(opt, StringBuff(opt->why_url)))/StringBuff(opt->why_url))/' \
+    "$src/htscore.c" >"$work/htscore.c"
+cmp -s "$src/htscore.c" "$work/htscore.c" && fail "the --why mutant changed nothing"
+lint "$work/htscore.c" >"$work/mut.out" && fail "the lint passed a raw why_url"
+grep -q 'unable to parse URL' "$work/mut.out" ||
+    fail "the --why mutant was not reported: $(<"$work/mut.out")"
+{
+    cat "$src/htsparse.c"
+    printf 'static void mutant(void) {\n  puts(lien);\n}\n'
+} >"$work/htsparse.c"
+lint "$work/htsparse.c" >"$work/mut.out" && fail "the lint passed puts(lien)"
+grep -q 'puts(lien)' "$work/mut.out" ||
+    fail "the puts mutant was not reported: $(<"$work/mut.out")"
+
+# Each form must be reported, and the safe ones not.
+cat >"$work/forms.c" <<'CEOF'
+f() {
+  hts_log_print(opt, LOG_INFO, "a %s", adr); /* hit */
+  hts_log_print(opt, LOG_INFO, "b %s%s", back[i].url_adr, fil); /* hit */
+  hts_log_vprint(opt, LOG_INFO, "c %s", urladr()); /* hit */
+  fprintf(opt->log, "d %s", r->adr); /* hit */
+  hts_log_print(opt, LOG_INFO, "e %s", adr_nologin(opt, adr));
+  hts_log_print(opt, LOG_INFO, "f %s", url_nologin(opt, url_adr));
+  hts_log_print(opt, LOG_INFO, "g %s", urladr() != NULL ? "x" : "y");
+  fprintf(fp, "h %s", adr);
+  hts_log_print(opt, LOG_INFO, "i adr %s", "adr");
+  printf("j %s", adr); /* hit */
+  fprintf(stderr, "k %s", heap(i)->adr); /* hit */
+  fputs(urladr(), stdout); /* hit */
+  fputs(adr, fp);
+  fprintf(ioinfo, "n %s", adr); /* hit */
+  hts_log_print(opt, LOG_INFO, "o %s", lien); /* hit */
+  printf("p %s %s", url, link); /* hit */
+  fprintf(stderr, "q %s", line); /* hit */
+  hts_log_print(opt, LOG_DEBUG, "r %s", codebase); /* hit */
+  printf("s %d", (int) sizeof(url));
+  /* printf("t %s", lien); */
+  printf("u // %s", "lien");
+  puts(lien_in); /* hit */
+  fprintfio(stderr, finalurl, ""); /* hit */
+  printf("v %s", opt->why_url); /* hit */
+  fprintfio(fp, url, "");
+  printf("w %s%s -> %s", url_fil, urlfil(), back->url_sav);
+  fputs(adr_nologin_r(buf, sizeof(buf), adr), stdout);
+#if HDEBUG
+  printf("l %s", adr);
+#else
+  printf("m %s", adr); /* hit */
+#endif
+}
+CEOF
+lint "$work/forms.c" >"$work/forms.out" && fail "the lint passed the raw forms"
+want=$(grep -n '/\* hit \*/' "$work/forms.c" | cut -d: -f1)
+assert_eq "$want" "$(cut -d: -f2 "$work/forms.out")" "lines reported"
+
+echo "log login lint OK"
diff --git a/tests/Makefile.am b/tests/Makefile.am
index d62dc1c3e..385e5f07a 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -15,7 +15,7 @@ EXTRA_DIST = $(TESTS) renamefail.c unlinkfail.c threadattrfail.c gaistall.c noba
 	pty-resize.py ttyrun.py test-timeout.sh png-colors.py \
 	local-crawl.sh local-server.py ftp-server.py testlib.sh proclib.sh \
 	webhttracklib.sh httpclient.py webtestlib.py crawllib.sh arclib.sh \
-	guide-image-check.py check-subshell-errexit.py \
+	guide-image-check.py check-subshell-errexit.py check-log-logins.py \
 	ci-windows-suite.sh ci-suite-stage.sh ci-windows-watchdog.ps1 install-headers-sweep.sh \
 	wsl2-exe-shim.sh \
 	server.crt server.key \
diff --git a/tests/check-log-logins.py b/tests/check-log-logins.py
new file mode 100644
index 000000000..3e9a68f50
--- /dev/null
+++ b/tests/check-log-logins.py
@@ -0,0 +1,186 @@
+#!/usr/bin/env python3
+"""List log calls that print an engine address without hiding its password.
+
+A log call is hts_log_print(), hts_log_vprint(), hts_secret_fprintf(),
+printf(), puts(), or fprintf(), fputs() or fprintfio() to a log file, stdout
+or stderr. Its
+arguments must pass every identifier containing adr, url, lien or link, and
+every line or codebase, through adr_nologin() or url_nologin(). A log file
+includes hts-ioinfo.txt. An allowed call is named "file: format" in ALLOW.
+Code under "#if 0" or a debug switch such as "#if HDEBUG" is skipped. A call
+through a macro wrapper, or an address held in an alias variable, is not
+detected.
+"""
+
+import re
+import sys
+
+CALL = re.compile(
+    r"\b(hts_log_print|hts_log_vprint|hts_secret_fprintf|printf|puts|fprintf|fputs"
+    r"|fprintfio)\s*\("
+)
+STREAM_FIRST = ("fprintf", "fprintfio")
+LOG_FILE = re.compile(r"(opt->log|log|fp_log|ioinfo|stdout|stderr)\s*$")
+SAFE = re.compile(
+    r"\b(adr_nologin|url_nologin|adr_nologin_r|url_nologin_r|jump_identification_const"
+    r"|jump_identification|text_excerpt)\s*\("
+)
+NAME = r"\b(\w*(adr|url|lien|link)\w*|line|codebase)\b"
+ADDRESS = re.compile(NAME)
+# Names that hold a path, a local file, a count or a mode, never an address.
+NOT_ADDRESS = re.compile(
+    r"\w*fil|\w*_sav\w*|lien_n|lien_tot|maxlink|\w*forbidden_url|urlmode"
+    r"|catch_url_strerror|shown_url"
+)
+NULL_TEST = re.compile(NAME + r"\s*(\(\s*\))?\s*[!=]=\s*NULL")
+SIZEOF = re.compile(r"\bsizeof\s*\(\s*\w+\s*\)")
+DEBUG_IF = re.compile(r"\s*#\s*if(def)?\s+(0|\w*DEBUG\w*(\s*==\s*\d+)?)\s*(/[/*].*)?$")
+# Calls whose address argument is not printed as text, with the reason.
+ALLOW = {
+    "htsback.c: Illegal chunk (%s) for %s%s": "chunk_adr is a chunk size",
+    "htsback.c: illegal chunk CRLF (%s) for %s%s": "chunk_adr is a chunk size",
+    "htscore.c: dump 1024 bytes (address %p): ": "a pointer",
+    "htscoremain.c: X-Host: %s\\r\\n": "the -#C cache dump lists the entry",
+    "htscoremain.c: X-URL: %s\\r\\nX-Cache-Entry-Unreadable: yes\\r\\n\\r\\n": "-#C",
+    "htscoremain.c: X-URL: %s\\r\\n": "-#C",
+    "htscoremain.c: %s\\r\\n": "r.adr is the page body",
+    "htsback.c: >>> ": "r.adr is the response header block",
+    "htscore.c: index redirect omitted: first link too long (%s)": "a local file",
+    "htshelp.c: \\tProxy's address: \\t%s\\n\\tProxy's port: \\t%d\\n": "a local proxy",
+    'htshelp.c: \\nThe URL is: \\"%s\\"\\n': "--catchurl hands the URL back",
+    'htshelp.c: You can capture it through: httrack \\"%s\\"\\n': "--catchurl",
+    "htsweb.c: URL=http://%s:%d/\\n": "the server's own address",
+}
+
+
+def drop_debug(src):
+    """Blanks the lines a debug switch compiles out, keeping line numbers."""
+    out, stack = [], []
+    for line in src.split("\n"):
+        if re.match(r"\s*#\s*if", line):
+            stack.append(bool(DEBUG_IF.match(line)) or (stack and stack[-1]))
+        elif re.match(r"\s*#\s*(else|elif)\b", line) and stack:
+            stack[-1] = len(stack) > 1 and stack[-2]
+        elif re.match(r"\s*#\s*endif\b", line) and stack:
+            stack.pop()
+            line = ""
+        out.append("" if stack and stack[-1] else line)
+    return "\n".join(out)
+
+
+def drop_comments(src):
+    """Blanks comments, keeping line numbers and string literals."""
+    out, i, quote = [], 0, None
+    while i < len(src):
+        c = src[i]
+        if quote:
+            if c == "\\":
+                out.append(src[i : i + 2])
+                i += 2
+                continue
+            if c == quote:
+                quote = None
+        elif c in "\"'":
+            quote = c
+        elif src.startswith("/*", i):
+            end = src.find("*/", i + 2)
+            end = len(src) if end < 0 else end + 2
+            out.append(re.sub(r"[^\n]", " ", src[i:end]))
+            i = end
+            continue
+        elif src.startswith("//", i):
+            end = src.find("\n", i)
+            i = len(src) if end < 0 else end
+            continue
+        out.append(c)
+        i += 1
+    return "".join(out)
+
+
+def call_end(s, i):
+    """Returns the index after the ')' closing the call opened before i."""
+    depth, quote = 1, None
+    while depth and i < len(s):
+        c = s[i]
+        if quote:
+            if c == "\\":
+                i += 1
+            elif c == quote:
+                quote = None
+        elif c in "\"'":
+            quote = c
+        elif c == "(":
+            depth += 1
+        elif c == ")":
+            depth -= 1
+        i += 1
+    return i
+
+
+def strip_literals(s):
+    return re.sub(r'"(\\.|[^"\\])*"' + r"|'(\\.|[^'\\])*'", '""', s)
+
+
+def strip_safe(s):
+    while True:
+        m = SAFE.search(s)
+        if m is None:
+            return s
+        s = s[: m.start()] + s[call_end(s, m.end()) :]
+
+
+def stream(call, name):
+    """Returns the FILE argument of an fprintf(), fprintfio() or fputs() call."""
+    args = strip_literals(call[call.index("(") + 1 : -1])
+    depth, parts, cur = 0, [], ""
+    for c in args:
+        if c == "," and depth == 0:
+            parts.append(cur)
+            cur = ""
+            continue
+        depth += {"(": 1, "[": 1, ")": -1, "]": -1}.get(c, 0)
+        cur += c
+    parts.append(cur)
+    return (parts[0] if name in STREAM_FIRST else parts[-1]).strip()
+
+
+def first_format(call):
+    m = re.search(r'"((\\.|[^"\\])*)"', call)
+    return m.group(1) if m else ""
+
+
+def main(paths):
+    hits = 0
+    used, names = set(), set()
+    for path in paths:
+        with open(path, encoding="latin-1") as f:
+            src = drop_debug(drop_comments(f.read()))
+        name = path.rsplit("/", 1)[-1]
+        names.add(name)
+        for m in CALL.finditer(src):
+            call = src[m.start() : call_end(src, m.end())]
+            if m.group(1) in STREAM_FIRST + ("fputs",) and not LOG_FILE.search(
+                stream(call, m.group(1))
+            ):
+                continue
+            args = strip_safe(strip_literals(call[call.index("(") + 1 :]))
+            args = SIZEOF.sub("", NULL_TEST.sub("", args))
+            if all(NOT_ADDRESS.fullmatch(a.group(0)) for a in ADDRESS.finditer(args)):
+                continue
+            key = "%s: %s" % (name, first_format(call))
+            if key in ALLOW:
+                used.add(key)
+                continue
+            line = src.count("\n", 0, m.start()) + 1
+            print("%s:%d: %s" % (path, line, " ".join(call.split())))
+            hits += 1
+    for key in sorted(ALLOW):
+        if key.split(":")[0] in names and key not in used:
+            print("stale ALLOW entry: %s" % key)
+            hits += 1
+    print("%d files, %d hits" % (len(paths), hits), file=sys.stderr)
+    return 1 if hits else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/tests/header-injection-server.py b/tests/header-injection-server.py
index a36c951df..1cc913cb9 100644
--- a/tests/header-injection-server.py
+++ b/tests/header-injection-server.py
@@ -14,6 +14,7 @@
 import socket
 import sys
 import threading
+import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
@@ -36,6 +37,39 @@ def root_page(port):
     )
 
 
+# a password in every form the engine reads one (657)
+PLANTED = (
+    "http://luser:LINKPWA@127.0.0.1:%(p)d/l1.html",
+    "//luser:LINKPWB@127.0.0.1:%(p)d/l2.html",
+    "http://luser:LINKPWC1 LINKPWC2@127.0.0.1:%(p)d/l3.html",
+    "http://luser:LINKPWD;q@127.0.0.1:%(p)d/l4.html",
+    "http://luser:LINKPWE@LINKPWF@127.0.0.1:%(p)d/l5.html",
+    "http://luser:LINKPWG%%40q@127.0.0.1:%(p)d/l6.html",
+    "http://luser:LINKPWH@[::1]:1/l7.html",
+    "http://luser:LINKPWI@127.0.0.1:%(p)d",
+    "http://luser:LINKPWJ@127.0.0.1:1/l8.html",
+    "mms://luser:SCHEMEPWM@127.0.0.1:%(p)d/m.asf",
+    "gopher://luser:SCHEMEPWG@127.0.0.1:%(p)d/g",
+    "  gopher://luser:SCHEMEPWL@127.0.0.1:%(p)d/g2",
+    "Mms://luser:SCHEMEPWC@127.0.0.1:%(p)d/m2.asf",
+    "HTTP://luser:LINKPWK@127.0.0.1:1/l9.html",
+    "x-y.z+w://luser:RELPW@h.example/a",
+    "/redir.html",
+)
+# the image loads while the engine waits on slow.html, so it is found ready
+PLANTED_FIRST = (
+    '<a href="/slow.html">s</a>'
+    '<img src="http://luser:LINKPWO@127.0.0.1:%(p)d/i.gif">'
+    "<style>body{background:url(http://luser:LINKPWU@127.0.0.1:%(p)d/bg.png)}</style>"
+    '<img data-src="http://u:DATAPW@127.0.0.1:%(p)d/{w}.jpg" src="/i.gif">'
+)
+
+
+def planted_page(port):
+    links = "".join('<a href="%s">l</a>' % (u % {"p": port}) for u in PLANTED)
+    return page(PLANTED_FIRST % {"p": port} + links)
+
+
 # the poisoned page must link onward, or its URL never becomes a Referer
 POISON_PAGE = page('<a href="/deep.html">deep</a>')
 # the ftp link takes the ftp-through-proxy emission site, which has no Host:
@@ -53,6 +87,8 @@ def body_for(request, port):
         return PROXY_ROOT
     if line.startswith(b"GET / "):
         return root_page(port)
+    if b"/planted.html" in line:
+        return planted_page(port)
     if b"/x" in line:
         return POISON_PAGE
     # one hop, so the second request of a crawl carries a Referer (328)
@@ -61,9 +97,37 @@ def body_for(request, port):
     # the proxied pages link onward too, so a poisoned *host* becomes a referer
     if b"/p.html" in line:
         return page('<a href="/deep2.html">deep</a>')
+    # the passwords of the start URL and of a link, and a -%X token, come back
+    # in a query, where the log's backstop hides only the token
+    if b"/token.html" in line:
+        return page(
+            '<a href="http://luser:LINKTOKQ2@127.0.0.1:%d/leaf.html">l</a>'
+            '<a href="/leaf.html?k=TOKENPWQ1">t</a>'
+            '<a href="/leaf.html?l=LINKTOKQ2">u</a>'
+            '<a href="/leaf.html?h=HDRTOKQ3">h</a>' % port
+        )
+    # sets a cookie and links on, so the next request sends it back (657)
+    if b"/setcookie.html" in line:
+        return page('<a href="/plain.html">plain</a>')
     return page("leaf")
 
 
+def extra_headers(request, port):
+    line = request.split(b"\r\n", 1)[0]
+    if b"/redir.html" in line:
+        return b"Location: http://ruser:LINKPWR@127.0.0.1:%d/hop.html\r\n" % port
+    if b"/setcookie.html" in line:
+        # a blank before the colon and a folded line still belong to the field
+        return (
+            b"Set-Cookie: srvsess=SETCOOKIESECRET; Path=/\r\n"
+            b"set-cookie\t: spaced=SPACEDSECRET;\r\n\tfolded=FOLDEDSECRET\r\n"
+            b"X-Visible: shown\r\n"
+            b"X-Cookie-Id: VISIBLE2\r\n"
+            b"Authorization-Info: VISIBLE4\r\n"
+        )
+    return b""
+
+
 def handle(conn, port, logf, lock, seq):
     conn.settimeout(10)
     data = b""
@@ -82,11 +146,25 @@ def handle(conn, port, logf, lock, seq):
             logf.flush()
             with open("%s.%d" % (sys.argv[1], seq[0]), "wb") as reqf:
                 reqf.write(data)
+        if b"/slow.html" in data.split(b"\r\n", 1)[0]:
+            time.sleep(2)
         body = body_for(data, port)
+        extra = extra_headers(data, port)
+        status = b"302 Found" if extra.startswith(b"Location:") else b"200 OK"
+        # a real image, which the engine finishes in the background (657)
+        image = b".gif " in data.split(b"\r\n", 1)[0]
+        if image:
+            body = b"GIF89a"
         try:
             conn.sendall(
-                b"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n"
-                b"Content-Length: %d\r\nConnection: close\r\n\r\n" % len(body) + body
+                b"HTTP/1.1 "
+                + status
+                + b"\r\nContent-Type: "
+                + (b"image/gif" if image else b"text/html")
+                + b"\r\n"
+                + extra
+                + b"Content-Length: %d\r\nConnection: close\r\n\r\n" % len(body)
+                + body
             )
         except OSError:
             pass