diff --git a/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php b/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
index 6a24454..8ae74de 100644
--- a/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
+++ b/core/modules/hal/src/Normalizer/ContentEntityNormalizer.php
@@ -63,6 +63,11 @@ public function __construct(LinkManagerInterface $link_manager, EntityManagerInt
    * Implements \Symfony\Component\Serializer\Normalizer\NormalizerInterface::normalize()
    */
   public function normalize($entity, $format = NULL, array $context = array()) {
+    $context += array(
+      'account' => NULL,
+      'included_fields' => NULL,
+    );
+
     // Create the array of normalized fields, starting with the URI.
     /** @var $entity \Drupal\Core\Entity\ContentEntityInterface */
     $normalized = array(
@@ -90,9 +95,12 @@ public function normalize($entity, $format = NULL, array $context = array()) {
     // Ignore the entity ID and revision ID.
     $exclude = array($entity->getEntityType()->getKey('id'), $entity->getEntityType()->getKey('revision'));
     foreach ($fields as $field) {
-      if (in_array($field->getFieldDefinition()->getName(), $exclude)) {
+      // Continue if this is an excluded field or the current user does not have
+      // access to view it.
+      if (in_array($field->getFieldDefinition()->getName(), $exclude) || !$field->access('view', $context['account'])) {
         continue;
       }
+
       $normalized_property = $this->serializer->normalize($field, $format, $context);
       $normalized = NestedArray::mergeDeep($normalized, $normalized_property);
     }
diff --git a/core/modules/hal/src/Tests/EntityTest.php b/core/modules/hal/src/Tests/EntityTest.php
index 47aa4d3..ff5faad 100644
--- a/core/modules/hal/src/Tests/EntityTest.php
+++ b/core/modules/hal/src/Tests/EntityTest.php
@@ -94,6 +94,9 @@ public function testTerm() {
     $vocabulary = entity_create('taxonomy_vocabulary', array('vid' => 'example_vocabulary'));
     $vocabulary->save();
 
+    $account = entity_create('user', array('name' => $this->randomMachineName()));
+    $account->save();
+
     // @todo Until https://www.drupal.org/node/2327935 is fixed, if no parent is
     // set, the test fails because target_id => 0 is reserialized to NULL.
     $term_parent = entity_create('taxonomy_term', array(
@@ -115,9 +118,9 @@ public function testTerm() {
     $original_values = $term->toArray();
     unset($original_values['tid']);
 
-    $normalized = $this->serializer->normalize($term, $this->format);
+    $normalized = $this->serializer->normalize($term, $this->format, ['account' => $account]);
 
-    $denormalized_term = $this->serializer->denormalize($normalized, 'Drupal\taxonomy\Entity\Term', $this->format);
+    $denormalized_term = $this->serializer->denormalize($normalized, 'Drupal\taxonomy\Entity\Term', $this->format, ['account' => $account]);
 
     // Verify that the ID and revision ID were skipped by the normalizer.
     $this->assertEqual(NULL, $denormalized_term->id());
@@ -135,8 +138,8 @@ public function testComment() {
     $node_type = entity_create('node_type', array('type' => 'example_type'));
     $node_type->save();
 
-    $user = entity_create('user', array('name' => $this->randomMachineName()));
-    $user->save();
+    $account = entity_create('user', array('name' => $this->randomMachineName()));
+    $account->save();
 
     // Add comment type.
     $this->container->get('entity.manager')->getStorage('comment_type')->create(array(
@@ -149,7 +152,7 @@ public function testComment() {
 
     $node = entity_create('node', array(
       'title' => $this->randomMachineName(),
-      'uid' => $user->id(),
+      'uid' => $account->id(),
       'type' => $node_type->id(),
       'status' => NODE_PUBLISHED,
       'promote' => 1,
@@ -162,7 +165,7 @@ public function testComment() {
     $node->save();
 
     $parent_comment = entity_create('comment', array(
-      'uid' => $user->id(),
+      'uid' => $account->id(),
       'subject' => $this->randomMachineName(),
       'comment_body' => [
         'value' => $this->randomMachineName(),
@@ -175,7 +178,7 @@ public function testComment() {
     $parent_comment->save();
 
     $comment = entity_create('comment', array(
-      'uid' => $user->id(),
+      'uid' => $account->id(),
       'subject' => $this->randomMachineName(),
       'comment_body' => [
         'value' => $this->randomMachineName(),
@@ -193,8 +196,8 @@ public function testComment() {
     $original_values = $comment->toArray();
     unset($original_values['cid']);
 
-    $normalized = $this->serializer->normalize($comment, $this->format);
-    $denormalized_comment = $this->serializer->denormalize($normalized, 'Drupal\comment\Entity\Comment', $this->format);
+    $normalized = $this->serializer->normalize($comment, $this->format, ['account' => $account]);
+    $denormalized_comment = $this->serializer->denormalize($normalized, 'Drupal\comment\Entity\Comment', $this->format, ['account' => $account]);
 
     // Verify that the ID and revision ID were skipped by the normalizer.
     $this->assertEqual(NULL, $denormalized_comment->id());
diff --git a/core/modules/rest/src/Tests/CreateTest.php b/core/modules/rest/src/Tests/CreateTest.php
index 20478c7..ae80b3c 100644
--- a/core/modules/rest/src/Tests/CreateTest.php
+++ b/core/modules/rest/src/Tests/CreateTest.php
@@ -41,7 +41,7 @@ public function testCreate() {
 
       $entity_values = $this->entityValues($entity_type);
       $entity = entity_create($entity_type, $entity_values);
-      $serialized = $serializer->serialize($entity, $this->defaultFormat);
+      $serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
       // Create the entity over the REST API.
       $this->httpRequest('entity/' . $entity_type, 'POST', $serialized, $this->defaultMimeType);
       $this->assertResponse(201);
@@ -69,7 +69,7 @@ public function testCreate() {
       // @see entity_test_entity_field_access()
       if ($entity_type == 'entity_test') {
         $entity->field_test_text->value = 'no access value';
-        $serialized = $serializer->serialize($entity, $this->defaultFormat);
+        $serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
         $this->httpRequest('entity/' . $entity_type, 'POST', $serialized, $this->defaultMimeType);
         $this->assertResponse(403);
         $this->assertFalse(entity_load_multiple($entity_type, NULL, TRUE), 'No entity has been created in the database.');
@@ -77,14 +77,14 @@ public function testCreate() {
         // Try to create a field with a text format this user has no access to.
         $entity->field_test_text->value = $entity_values['field_test_text'][0]['value'];
         $entity->field_test_text->format = 'full_html';
-        $serialized = $serializer->serialize($entity, $this->defaultFormat);
+        $serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
         $this->httpRequest('entity/' . $entity_type, 'POST', $serialized, $this->defaultMimeType);
         $this->assertResponse(422);
         $this->assertFalse(entity_load_multiple($entity_type, NULL, TRUE), 'No entity has been created in the database.');
 
         // Restore the valid test value.
         $entity->field_test_text->format = 'plain_text';
-        $serialized = $serializer->serialize($entity, $this->defaultFormat);
+        $serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
       }
 
       // Try to send invalid data that cannot be correctly deserialized.
@@ -98,7 +98,7 @@ public function testCreate() {
       // Try to send invalid data to trigger the entity validation constraints.
       // Send a UUID that is too long.
       $entity->set('uuid', $this->randomMachineName(129));
-      $invalid_serialized = $serializer->serialize($entity, $this->defaultFormat);
+      $invalid_serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
       $response = $this->httpRequest('entity/' . $entity_type, 'POST', $invalid_serialized, $this->defaultMimeType);
       $this->assertResponse(422);
       $error = Json::decode($response);
diff --git a/core/modules/rest/src/Tests/UpdateTest.php b/core/modules/rest/src/Tests/UpdateTest.php
index 3d133c9..0893bb4 100644
--- a/core/modules/rest/src/Tests/UpdateTest.php
+++ b/core/modules/rest/src/Tests/UpdateTest.php
@@ -52,7 +52,7 @@ public function testPatchUpdate() {
     $patch_entity = entity_create($entity_type, $patch_values);
     // We don't want to overwrite the UUID.
     unset($patch_entity->uuid);
-    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat);
+    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat, ['account' => $account]);
 
     // Update the entity over the REST API.
     $this->httpRequest($entity->getSystemPath(), 'PATCH', $serialized, $this->defaultMimeType);
@@ -101,7 +101,7 @@ public function testPatchUpdate() {
 
     // Try to update an access protected field.
     $patch_entity->get('field_test_text')->value = 'no access value';
-    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat);
+    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat, ['account' => $account]);
     $this->httpRequest($entity->getSystemPath(), 'PATCH', $serialized, $this->defaultMimeType);
     $this->assertResponse(403);
 
@@ -114,7 +114,7 @@ public function testPatchUpdate() {
       'value' => 'test',
       'format' => 'full_html',
     ));
-    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat);
+    $serialized = $serializer->serialize($patch_entity, $this->defaultFormat, ['account' => $account]);
     $this->httpRequest($entity->getSystemPath(), 'PATCH', $serialized, $this->defaultMimeType);
     $this->assertResponse(422);
 
@@ -139,7 +139,7 @@ public function testPatchUpdate() {
     // Try to send invalid data to trigger the entity validation constraints.
     // Send a UUID that is too long.
     $entity->set('uuid', $this->randomMachineName(129));
-    $invalid_serialized = $serializer->serialize($entity, $this->defaultFormat);
+    $invalid_serialized = $serializer->serialize($entity, $this->defaultFormat, ['account' => $account]);
     $response = $this->httpRequest($entity->getSystemPath(), 'PATCH', $invalid_serialized, $this->defaultMimeType);
     $this->assertResponse(422);
     $error = Json::decode($response);
diff --git a/core/modules/serialization/serialization.services.yml b/core/modules/serialization/serialization.services.yml
index 389ac05..f32fac0 100644
--- a/core/modules/serialization/serialization.services.yml
+++ b/core/modules/serialization/serialization.services.yml
@@ -7,6 +7,11 @@ services:
     tags:
       - { name: normalizer }
     arguments: ['@entity.manager']
+  serializer.normalizer.content_entity:
+      class: Drupal\serialization\Normalizer\ContentEntityNormalizer
+      tags:
+        - { name: normalizer }
+      arguments: ['@entity.manager']
   serializer.normalizer.entity:
     class: Drupal\serialization\Normalizer\EntityNormalizer
     tags:
diff --git a/core/modules/serialization/src/Normalizer/ContentEntityNormalizer.php b/core/modules/serialization/src/Normalizer/ContentEntityNormalizer.php
new file mode 100644
index 0000000..b0ed110
--- /dev/null
+++ b/core/modules/serialization/src/Normalizer/ContentEntityNormalizer.php
@@ -0,0 +1,40 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\serialization\Normalizer\ContentEntityNormalizer.
+ */
+
+namespace Drupal\serialization\Normalizer;
+
+/**
+ * Normalizes/denormalizes Drupal content entities into an array structure.
+ */
+class ContentEntityNormalizer extends EntityNormalizer {
+
+  /**
+   * The interface or class that this Normalizer supports.
+   *
+   * @var array
+   */
+  protected $supportedInterfaceOrClass = array('Drupal\Core\Entity\ContentEntityInterface');
+
+  /**
+   * {@inheritdoc}
+   */
+  public function normalize($object, $format = NULL, array $context = array()) {
+    $context += array(
+      'account' => NULL,
+    );
+
+    $attributes = array();
+    foreach ($object as $name => $field) {
+      if ($field->access('view', $context['account'])) {
+        $attributes[$name] = $this->serializer->normalize($field, $format, $context);
+      }
+    }
+
+    return $attributes;
+  }
+
+}
diff --git a/core/modules/serialization/src/Tests/EntitySerializationTest.php b/core/modules/serialization/src/Tests/EntitySerializationTest.php
index 849b271..d45c2a6 100644
--- a/core/modules/serialization/src/Tests/EntitySerializationTest.php
+++ b/core/modules/serialization/src/Tests/EntitySerializationTest.php
@@ -9,6 +9,7 @@
 
 use Drupal\Core\Language\LanguageInterface;
 use Drupal\Component\Utility\String;
+use Drupal\user\Entity\User;
 
 /**
  * Tests that entities can be serialized to supported core formats.
@@ -48,6 +49,8 @@ class EntitySerializationTest extends NormalizerTestBase {
   protected function setUp() {
     parent::setUp();
 
+    // User create needs sequence table.
+    $this->installSchema('system', array('sequences'));
     // Create a test entity to serialize.
     $this->values = array(
       'name' => $this->randomMachineName(),
@@ -105,6 +108,17 @@ public function testNormalize() {
       $this->assertEqual($expected[$fieldName], $normalized[$fieldName], "ComplexDataNormalizer produces expected array for $fieldName.");
     }
     $this->assertEqual(array_diff_key($normalized, $expected), array(), 'No unexpected data is added to the normalized array.');
+
+    // Test password isn't available.
+    $account = User::create([
+      'name' => 'foo',
+      'mail' => 'foo@example.com',
+      'pass' => '123456',
+    ]);
+    $account->save();
+    $normalized = $this->serializer->normalize($account);
+    $this->assertTrue(empty($normalized['pass']));
+    $this->assertTrue(empty($normalized['mail']));
   }
 
   /**