diff --git a/outputs.tf b/outputs.tf
index 59c8b35..3c9ce9c 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -31,6 +31,7 @@ output "iam_email" {
 
 output "key" {
   description = "Service account key (for single use)."
+  sensitive   = true
   value       = var.generate_keys ? base64decode(google_service_account_key.keys[var.names[0]].private_key) : ""
 }