diff --git a/src/iri.c b/src/iri.c
index a6b1c6e2..c9505ce8 100644
--- a/src/iri.c
+++ b/src/iri.c
@@ -152,7 +152,14 @@ do_conversion (const char *tocode, const char *fromcode, char const *in_org, siz
           *(s + len - outlen - done) = '\0';
           xfree(in_save);
           iconv_close(cd);
-          DEBUGP (("converted '%s' (%s) -> '%s' (%s)\n", in_org, fromcode, *out, tocode));
+          IF_DEBUG
+          {
+            /* not not print out embedded passwords, in_org might be an URL */
+            if (!strchr(in_org, '@') && !strchr(*out, '@'))
+              debug_logprintf ("converted '%s' (%s) -> '%s' (%s)\n", in_org, fromcode, *out, tocode);
+            else
+              debug_logprintf ("%s: logging suppressed, strings may contain password\n", __func__);
+          }
           return true;
         }
 
@@ -193,7 +200,14 @@ do_conversion (const char *tocode, const char *fromcode, char const *in_org, siz
 
     xfree(in_save);
     iconv_close(cd);
-    DEBUGP (("converted '%s' (%s) -> '%s' (%s)\n", in_org, fromcode, *out, tocode));
+    IF_DEBUG
+    {
+      /* not not print out embedded passwords, in_org might be an URL */
+      if (!strchr(in_org, '@') && !strchr(*out, '@'))
+        debug_logprintf ("converted '%s' (%s) -> '%s' (%s)\n", in_org, fromcode, *out, tocode);
+      else
+        debug_logprintf ("%s: logging suppressed, strings may contain password\n", __func__);
+    }
     return false;
 }