diff --git a/commands/core/outputformat.drush.inc b/commands/core/outputformat.drush.inc
index 0164e0d..923f07e 100644
--- a/commands/core/outputformat.drush.inc
+++ b/commands/core/outputformat.drush.inc
@@ -256,6 +256,16 @@ class drush_outputformat {
   }
   function process($input, $metadata = array()) {
     $metadata += $this->engine_config;
+    if (isset($metadata['private-fields']) && is_array($input)) {
+      if (!drush_get_option('show-passwords', FALSE)) {
+        if (!is_array($metadata['private-fields'])) {
+          $metadata['private-fields'] = array($metadata['private-fields']);
+        }
+        foreach ($metadata['private-fields'] as $private) {
+          drush_unset_recursive($input, $private);
+        }
+      }
+    }
     if (isset($metadata['fields']) && is_array($input)) {
       $first_value = reset($input);
       if (is_array($first_value)) {
diff --git a/commands/sql/sql.drush.inc b/commands/sql/sql.drush.inc
index f44178a..37dbd4a 100644
--- a/commands/sql/sql.drush.inc
+++ b/commands/sql/sql.drush.inc
@@ -54,6 +54,11 @@ function sql_drush_command() {
       'all' => 'Show all database connections, instead of just one.',
       'show-passwords' => 'Show database password.',
     ) + $options,
+    'outputformat' => array(
+      'default' => 'print-r',
+      'pipe-format' => 'export',
+      'private-fields' => 'password',
+    ),
   );
   $items['sql-connect'] = array(
     'description' => 'A string for connecting to the DB.',
@@ -241,12 +246,7 @@ function drush_sql_conf() {
   if (!isset($db_spec)) {
     $db_spec = _drush_sql_get_db_spec();
   }
-  $return = $db_spec;
-  if (!drush_get_option('show-passwords', FALSE)) {
-    drush_unset_recursive($db_spec, 'password');
-  }
-  drush_print_r($db_spec);
-  return $return;
+  return $db_spec;
 }
 
 /**
diff --git a/includes/command.inc b/includes/command.inc
index e93642a..98d0d22 100644
--- a/includes/command.inc
+++ b/includes/command.inc
@@ -1085,6 +1085,10 @@ function _drush_command_translate($source) {
  *       possible field names should appear in this list.
  *     - 'fields-default': A list of the machine names of the fields that
  *       should be displayed by default in tables.
+ *     - 'private-fields': A list of any fields that contain sensitive
+ *       information, such as passwords.  By default, Drush will hide private
+ *       fields before printing the results to the console, but will include
+ *       them in backend invoke results. Use --show-passwords to display.
  *     - 'column-widths': A mapping from field machine name to the column width
  *       that should be used in table output.  Drush will automatically
  *       calculate the width of any field not listed here based on the length