diff --git a/bcs-services/bcs-cluster-manager/internal/actions/nodegroup/get.go b/bcs-services/bcs-cluster-manager/internal/actions/nodegroup/get.go
index 88eeb47280..bfc9fd03fb 100644
--- a/bcs-services/bcs-cluster-manager/internal/actions/nodegroup/get.go
+++ b/bcs-services/bcs-cluster-manager/internal/actions/nodegroup/get.go
@@ -75,13 +75,33 @@ func (ga *GetAction) Handle(
 }
 
 func removeSensitiveInfo(group *cmproto.NodeGroup) *cmproto.NodeGroup {
+	shield := func(key string) string {
+		keyBytes := []byte(key)
+		if len(keyBytes) <= 4 {
+			return string(keyBytes)
+		}
+		size := len(keyBytes)
+
+		resultKeys := make([]byte, 0)
+		for i := range keyBytes {
+			if i < 2 || i >= (size-2) {
+				resultKeys = append(resultKeys, keyBytes[i])
+				continue
+			}
+
+			resultKeys = append(resultKeys, '*')
+		}
+
+		return string(resultKeys)
+	}
+
 	if group != nil && group.LaunchTemplate != nil {
 		if group.LaunchTemplate.InitLoginPassword != "" {
-			group.LaunchTemplate.InitLoginPassword = utils.RandomString(8)
+			group.LaunchTemplate.InitLoginPassword = shield(group.LaunchTemplate.InitLoginPassword)
 		}
 		if group.LaunchTemplate.KeyPair != nil {
 			if group.LaunchTemplate.KeyPair.KeyPublic != "" {
-				group.LaunchTemplate.KeyPair.KeyPublic = utils.RandomString(8)
+				group.LaunchTemplate.KeyPair.KeyPublic = shield(group.LaunchTemplate.KeyPair.KeyPublic)
 			}
 			group.LaunchTemplate.KeyPair.KeySecret = ""
 		}