diff --git a/src/app/(dashboard)/settings/upload-sources/page.tsx b/src/app/(dashboard)/settings/upload-sources/page.tsx
index 29ebf9b..54d6ba6 100644
--- a/src/app/(dashboard)/settings/upload-sources/page.tsx
+++ b/src/app/(dashboard)/settings/upload-sources/page.tsx
@@ -120,10 +120,14 @@ export default function UploadSourcesPage() {
   const handleSave = async () => {
     setSaving(true);
     try {
+      const payload = { ...settings } as Record<string, unknown>;
+      if (payload.emailImapPass === "••••••••") delete payload.emailImapPass;
+      if (payload.ftpPass === "••••••••") delete payload.ftpPass;
+
       const res = await fetch("/api/settings", {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(settings),
+        body: JSON.stringify(payload),
       });
       if (!res.ok) throw new Error();
       toast.success("Upload source settings saved");
diff --git a/src/app/api/email-watch/test/route.ts b/src/app/api/email-watch/test/route.ts
index 8ce0ad5..862b4ac 100644
--- a/src/app/api/email-watch/test/route.ts
+++ b/src/app/api/email-watch/test/route.ts
@@ -1,6 +1,9 @@
 import { NextRequest, NextResponse } from "next/server";
 import { testEmailConnection } from "@/lib/email-watcher";
 import { requireApiAuth, handleApiError } from "@/lib/api-auth";
+import { prisma } from "@/lib/db";
+
+const MASKED = "••••••••";
 
 export async function POST(request: NextRequest) {
   try {
@@ -10,9 +13,14 @@ export async function POST(request: NextRequest) {
     const host = String(body.host || "");
     const port = parseInt(String(body.port)) || 993;
     const user = String(body.user || "");
-    const pass = String(body.pass || "");
+    let pass = String(body.pass || "");
     const tls = body.tls !== false;
 
+    if (!pass || pass === MASKED) {
+      const settings = await prisma.appSettings.findUnique({ where: { id: "singleton" } });
+      pass = settings?.emailImapPass || "";
+    }
+
     if (!host || !user || !pass) {
       return NextResponse.json(
         { error: "Host, username, and password are required" },
diff --git a/src/app/api/ftp-watch/test/route.ts b/src/app/api/ftp-watch/test/route.ts
index 9376bdd..00bfef8 100644
--- a/src/app/api/ftp-watch/test/route.ts
+++ b/src/app/api/ftp-watch/test/route.ts
@@ -1,16 +1,26 @@
 import { NextRequest, NextResponse } from "next/server";
 import { testFtpConnection } from "@/lib/ftp-watcher";
 import { requireApiAuth, handleApiError } from "@/lib/api-auth";
+import { prisma } from "@/lib/db";
+
+const MASKED = "••••••••";
 
 export async function POST(request: NextRequest) {
   try {
     await requireApiAuth();
     const body = await request.json();
+
+    let pass = body.pass || "";
+    if (!pass || pass === MASKED) {
+      const settings = await prisma.appSettings.findUnique({ where: { id: "singleton" } });
+      pass = settings?.ftpPass || "";
+    }
+
     const result = await testFtpConnection({
       host: body.host,
       port: body.port || 21,
       user: body.user,
-      pass: body.pass,
+      pass,
       tls: body.tls ?? true,
       incomingDir: body.incomingDir || "/incoming",
     });