diff --git a/src/core/api/user.go b/src/core/api/user.go
index 353001bf7..f0e852cbe 100644
--- a/src/core/api/user.go
+++ b/src/core/api/user.go
@@ -203,7 +203,10 @@ func (ua *UserAPI) List() {
 		ua.SendInternalServerError(fmt.Errorf("failed to get users: %v", err))
 		return
 	}
-
+	for i := range users {
+		user := &users[i]
+		user.Password = ""
+	}
 	ua.SetPaginationHeader(total, page, size)
 	ua.Data["json"] = users
 	ua.ServeJSON()