diff --git a/lisp/gnus/auth-source.el b/lisp/gnus/auth-source.el
index 1bec08f..64166aa 100644
--- a/lisp/gnus/auth-source.el
+++ b/lisp/gnus/auth-source.el
@@ -100,6 +100,12 @@
   :version "23.1" ;; No Gnus
   :type `boolean)
 
+(defcustom auth-source-debug nil
+  "Whether auth-source should log debug messages."
+  :group 'auth-source
+  :version "23.1" ;; No Gnus
+  :type `boolean)
+
 (defcustom auth-sources '((:source "~/.authinfo.gpg" :host t :protocol t))
   "List of authentication sources.
 
@@ -137,6 +143,10 @@ Each entry is the authentication type with optional properties."
 ;; (auth-source-user-or-password-imap "password" "imap.myhost.com")
 ;; (auth-source-protocol-defaults 'imap)
 
+(defun auth-source-debug (&rest msg)
+  (when auth-source-debug
+    (apply 'message msg)))
+
 (defun auth-source-pick (host protocol &optional fallback)
   "Parse `auth-sources' for HOST, and PROTOCOL matches.
 
@@ -171,21 +181,21 @@ Returns fallback choices (where PROTOCOL or HOST are nil) with FALLBACK t."
 (defun auth-source-user-or-password (mode host protocol)
   "Find MODE (string or list of strings) matching HOST and PROTOCOL.
 MODE can be \"login\" or \"password\" for example."
-  (gnus-message 9
-		"auth-source-user-or-password: get %s for %s (%s)"
-		mode host protocol)
+  (auth-source-debug
+   "auth-source-user-or-password: get %s for %s (%s)"
+   mode host protocol)
   (let* ((listy (listp mode))
 	 (mode (if listy mode (list mode)))
 	 (cname (format "%s %s:%s" mode host protocol))
 	 (found (gethash cname auth-source-cache)))
     (if found
 	(progn
-	  (gnus-message 9
-			"auth-source-user-or-password: cached %s=%s for %s (%s)"
-			mode
-			;; don't show the password
-			(if (member "password" mode) "SECRET" found)
-			host protocol)
+	  (auth-source-debug
+	   "auth-source-user-or-password: cached %s=%s for %s (%s)"
+	   mode
+	   ;; don't show the password
+	   (if (and (member "password" mode) auth-source-hide-passwords) "SECRET" found)
+	   host protocol)
 	  found)
       (dolist (choice (auth-source-pick host protocol))
 	(setq found (netrc-machine-user-or-password
@@ -195,12 +205,12 @@ MODE can be \"login\" or \"password\" for example."
 		     (list (format "%s" protocol))
 		     (auth-source-protocol-defaults protocol)))
 	(when found
-	  (gnus-message 9
-			"auth-source-user-or-password: found %s=%s for %s (%s)"
-			mode
-			;; don't show the password
-			(if (member "password" mode) "SECRET" found)
-			host protocol)
+	  (auth-source-debug
+	   "auth-source-user-or-password: found %s=%s for %s (%s)"
+	   mode
+	   ;; don't show the password
+	   (if (and (member "password" mode) auth-source-hide-passwords) "SECRET" found)
+	   host protocol)
 	  (setq found (if listy found (car-safe found)))
 	  (when auth-source-do-cache
 	    (puthash cname found auth-source-cache)))