diff --git a/src/MongoDB.Driver/AutoEncryptionOptions.cs b/src/MongoDB.Driver/AutoEncryptionOptions.cs
index ea2e0d30b9f..9638139cfdf 100644
--- a/src/MongoDB.Driver/AutoEncryptionOptions.cs
+++ b/src/MongoDB.Driver/AutoEncryptionOptions.cs
@@ -294,7 +294,8 @@ public override string ToString()
             {
                 sb.AppendFormat("KeyExpiration : {0}, ", _keyExpiration.Value);
             }
-            sb.AppendFormat("KmsProviders : {0}, ", _kmsProviders.ToJson(jsonWriterSettings));
+            // redact every option value, so providers added later cannot leak credentials by default
+            sb.AppendFormat("KmsProviders : {0}, ", new BsonDocument(_kmsProviders.Select(p => new BsonElement(p.Key, "<hidden>"))).ToJson(jsonWriterSettings));
             if (_keyVaultNamespace != null)
             {
                 sb.AppendFormat("KeyVaultNamespace : \"{0}\", ", _keyVaultNamespace.FullName);
diff --git a/tests/MongoDB.Driver.Tests/Encryption/AutoEncryptionOptionsTests.cs b/tests/MongoDB.Driver.Tests/Encryption/AutoEncryptionOptionsTests.cs
index 0757c1635d0..e9ef87e3168 100644
--- a/tests/MongoDB.Driver.Tests/Encryption/AutoEncryptionOptionsTests.cs
+++ b/tests/MongoDB.Driver.Tests/Encryption/AutoEncryptionOptionsTests.cs
@@ -354,7 +354,34 @@ public void ToString_should_return_expected_result()
                 encryptedFieldsMap: encryptedFieldsMap);
 
             var result = subject.ToString();
-            result.Should().Be("{ BypassAutoEncryption : True, BypassQueryAnalysis : False, KmsProviders : { \"provider1\" : { \"string\" : \"test\" }, \"provider2\" : { \"binary\" : { \"_t\" : \"System.Byte[]\", \"_v\" : { \"$binary\" : { \"base64\" : \"ABEiM0RVZneImaq7zN3u/w==\", \"subType\" : \"00\" } } } } }, KeyVaultNamespace : \"db.coll\", ExtraOptions : { \"mongocryptdURI\" : \"testURI\" }, SchemaMap : { \"coll1\" : { \"string\" : \"test\" }, \"coll2\" : { \"binary\" : { \"$binary\" : { \"base64\" : \"ABEiM0RVZneImaq7zN3u/w==\", \"subType\" : \"04\" } } } }, TlsOptions : [{ \"local\" : \"<hidden>\" }], EncryptedFieldsMap : { \"db.test\" : { \"dummy\" : \"doc\" } } }");
+            result.Should().Be("{ BypassAutoEncryption : True, BypassQueryAnalysis : False, KmsProviders : { \"provider1\" : \"<hidden>\", \"provider2\" : \"<hidden>\" }, KeyVaultNamespace : \"db.coll\", ExtraOptions : { \"mongocryptdURI\" : \"testURI\" }, SchemaMap : { \"coll1\" : { \"string\" : \"test\" }, \"coll2\" : { \"binary\" : { \"$binary\" : { \"base64\" : \"ABEiM0RVZneImaq7zN3u/w==\", \"subType\" : \"04\" } } } }, TlsOptions : [{ \"local\" : \"<hidden>\" }], EncryptedFieldsMap : { \"db.test\" : { \"dummy\" : \"doc\" } } }");
+        }
+
+        [Fact]
+        public void ToString_should_not_expose_kms_provider_credentials()
+        {
+            var kmsProviders = new Dictionary<string, IReadOnlyDictionary<string, object>>
+            {
+                { "local", new Dictionary<string, object> { { "key", new byte[96] } } },
+                { "aws", new Dictionary<string, object> { { "accessKeyId", "id" }, { "secretAccessKey", "secret" } } },
+                { "aws:named", new Dictionary<string, object> { { "accessKeyId", "id" }, { "secretAccessKey", "secret" } } }
+            };
+
+            var subject = new AutoEncryptionOptions(__keyVaultNamespace, kmsProviders);
+
+            var result = subject.ToString();
+
+            result.Should().Be("{ BypassAutoEncryption : False, KmsProviders : { \"local\" : \"<hidden>\", \"aws\" : \"<hidden>\", \"aws:named\" : \"<hidden>\" }, KeyVaultNamespace : \"db.coll\", TlsOptions : [] }");
+        }
+
+        [Fact]
+        public void ToString_should_return_expected_result_when_kmsProviders_is_empty()
+        {
+            var subject = new AutoEncryptionOptions(__keyVaultNamespace, new Dictionary<string, IReadOnlyDictionary<string, object>>());
+
+            var result = subject.ToString();
+
+            result.Should().Be("{ BypassAutoEncryption : False, KmsProviders : { }, KeyVaultNamespace : \"db.coll\", TlsOptions : [] }");
         }
 
         // private methods