diff --git a/cli/login.go b/cli/login.go
index dfba4f3b4cfb0..65a94d8a4ec3e 100644
--- a/cli/login.go
+++ b/cli/login.go
@@ -287,7 +287,8 @@ func (r *RootCmd) login() *serpent.Command {
 				}
 
 				sessionToken, err = cliui.Prompt(inv, cliui.PromptOptions{
-					Text: "Paste your token here:",
+					Text:   "Paste your token here:",
+					Secret: true,
 					Validate: func(token string) error {
 						client.SetSessionToken(token)
 						_, err := client.User(ctx, codersdk.Me)