diff --git a/REFERENCE.md b/REFERENCE.md
index 73a133d7c0a0ebc038f5fb05db017b6af1bebcc7..c40a5eb3215a38164a6f5c5a60a38adba0618726 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -198,11 +198,11 @@ Default value: `'u_cfssl'`
 
 ##### <a name="dbpassword"></a>`dbpassword`
 
-Data type: `String[1]`
+Data type: `Variant[String[1], Sensitive[String]]`
 
 A password of the dbuser.
 
-Default value: `'changeme'`
+Default value: `('changeme')`
 
 ##### <a name="confdir"></a>`confdir`
 
diff --git a/manifests/init.pp b/manifests/init.pp
index 4970f61fc96feb0622d042f70425eae5bb3c084d..09269d07bf533f13afda5bf0a86d68524eb18d22 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -62,7 +62,7 @@ class cfssl (
   Stdlib::Absolutepath $logdir = '/var/log/cfssl',
   String[1] $dbname = 'db_cfssl',
   String[1] $dbuser = 'u_cfssl',
-  String[1] $dbpassword = 'changeme',
+  Variant[String[1], Sensitive[String]] $dbpassword = Sensitive.new('changeme'),
   Stdlib::Absolutepath $confdir = '/etc/cfssl',
   Stdlib::Absolutepath $binpath = '/usr/local/bin',
   Hash $rootca_manifest = { cn => 'EXEMPLE ROOT CA', subject => { 'C' => 'FR', 'L' => 'MONTPELLIER', 'O' => 'EXEMPLE ORG', } },