diff --git a/REFERENCE.md b/REFERENCE.md
index cea8beaf..f36f4f03 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -361,7 +361,7 @@ Default value: `[]`
 
 ##### <a name="-bacula--client--password"></a>`password`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 A password to use for communication with this File Daemon
 
@@ -557,7 +557,7 @@ Default value: `'bacula'`
 
 ##### <a name="-bacula--director--db_pw"></a>`db_pw`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 The database user's password
 
@@ -654,7 +654,7 @@ Default value: `true`
 
 ##### <a name="-bacula--director--password"></a>`password`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 password to connect to the director
 
@@ -882,7 +882,7 @@ Default value: `'File'`
 
 ##### <a name="-bacula--storage--password"></a>`password`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 Specifies the password that must be supplied by the named Director
 
@@ -977,7 +977,7 @@ The port of the Bacula File server daemon
 
 ##### <a name="-bacula--director--client--password"></a>`password`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 The password to be used when establishing a connection with the File services
 
@@ -1301,7 +1301,7 @@ Default value: `9103`
 
 ##### <a name="-bacula--director--storage--password"></a>`password`
 
-Data type: `String`
+Data type: `Variant[String,Sensitive[String]]`
 
 Bacula director configuration for Storage option 'Password'
 
diff --git a/manifests/client.pp b/manifests/client.pp
index dcaf1cbe..10a12e4e 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -59,7 +59,7 @@
   Optional[String]        $default_pool_diff,
   Integer                 $port                = 9102,
   Array[String[1]]        $listen_address      = [],
-  String                  $password            = 'secret',
+  Variant[String,Sensitive[String]] $password  = 'secret',
   Integer                 $max_concurrent_jobs = 2,
   String                  $director_name       = $bacula::director_name,
   Bacula::Yesno           $autoprune           = true,
diff --git a/manifests/director.pp b/manifests/director.pp
index 40e0b7b1..94cdd532 100644
--- a/manifests/director.pp
+++ b/manifests/director.pp
@@ -42,7 +42,7 @@
   Bacula::Yesno                 $manage_db           = true,
   String                        $conf_dir            = $bacula::conf_dir,
   String                        $db_name             = 'bacula',
-  String                        $db_pw               = 'notverysecret',
+  Variant[String,Sensitive[String]] $db_pw           = 'notverysecret',
   String                        $db_user             = 'bacula',
   Optional[String]              $db_address          = undef,
   Optional[String]              $db_port             = undef,
@@ -54,7 +54,7 @@
   Array[String[1]]              $listen_address      = [],
   Integer                       $max_concurrent_jobs = 20,
   Boolean                       $manage_defaults     = true,
-  String                        $password            = 'secret',
+  Variant[String,Sensitive[String]] $password        = 'secret',
   Integer                       $port                = 9101,
   String                        $rundir              = $bacula::rundir,
   String                        $storage_name        = $bacula::storage_name,
diff --git a/manifests/director/client.pp b/manifests/director/client.pp
index af162365..2df40471 100644
--- a/manifests/director/client.pp
+++ b/manifests/director/client.pp
@@ -25,7 +25,7 @@
 define bacula::director::client (
   String                  $address,
   Variant[String,Integer] $port, # FIXME: Remove String
-  String                  $password,
+  Variant[String,Sensitive[String]] $password,
   Bacula::Time            $file_retention,
   Bacula::Time            $job_retention,
   Bacula::Yesno           $autoprune,
diff --git a/manifests/director/storage.pp b/manifests/director/storage.pp
index 4f4a47b9..5a332306 100644
--- a/manifests/director/storage.pp
+++ b/manifests/director/storage.pp
@@ -18,7 +18,7 @@
 define bacula::director::storage (
   String  $address       = $name,
   Integer $port          = 9103,
-  String  $password      = 'secret',
+  Variant[String,Sensitive[String]] $password = 'secret',
   String  $device_name   = "${facts['networking']['fqdn']}-device",
   String  $media_type    = 'File',
   Integer $maxconcurjobs = 1,
diff --git a/manifests/storage.pp b/manifests/storage.pp
index f407d648..f102d80a 100644
--- a/manifests/storage.pp
+++ b/manifests/storage.pp
@@ -39,7 +39,7 @@
   Array[String[1]]    $listen_address = [],
   Integer             $maxconcurjobs  = 5,
   String              $media_type     = 'File',
-  String              $password       = 'secret',
+  Variant[String,Sensitive[String]] $password = 'secret',
   Integer             $port           = 9103,
   String              $rundir         = $bacula::rundir,
   String              $storage        = $trusted['certname'], # storage here is not storage_name