diff --git a/backend/box/box.go b/backend/box/box.go
index cb89f8cb5..834e02364 100644
--- a/backend/box/box.go
+++ b/backend/box/box.go
@@ -25,6 +25,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/lib/dircache"
@@ -58,7 +59,7 @@ var (
 			TokenURL: "https://app.box.com/api/oauth2/token",
 		},
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectURL,
 	}
 	uploadCutoff = fs.SizeSuffix(50 * 1024 * 1024)
diff --git a/backend/cache/cache.go b/backend/cache/cache.go
index 874fe4975..9863f92a4 100644
--- a/backend/cache/cache.go
+++ b/backend/cache/cache.go
@@ -20,6 +20,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/fs/walk"
 	"github.com/pkg/errors"
@@ -308,7 +309,7 @@ func NewFs(name, rpath string) (fs.Fs, error) {
 			plexUsername := config.FileGet(name, "plex_username")
 			plexPassword := config.FileGet(name, "plex_password")
 			if plexPassword != "" && plexUsername != "" {
-				decPass, err := config.Reveal(plexPassword)
+				decPass, err := obscure.Reveal(plexPassword)
 				if err != nil {
 					decPass = plexPassword
 				}
diff --git a/backend/crypt/crypt.go b/backend/crypt/crypt.go
index 0ca714f0d..d395385d6 100644
--- a/backend/crypt/crypt.go
+++ b/backend/crypt/crypt.go
@@ -12,6 +12,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/pkg/errors"
 )
@@ -86,13 +87,13 @@ func NewFs(name, rpath string) (fs.Fs, error) {
 	if password == "" {
 		return nil, errors.New("password not set in config file")
 	}
-	password, err = config.Reveal(password)
+	password, err = obscure.Reveal(password)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to decrypt password")
 	}
 	salt := config.FileGet(name, "password2", "")
 	if salt != "" {
-		salt, err = config.Reveal(salt)
+		salt, err = obscure.Reveal(salt)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to decrypt password2")
 		}
diff --git a/backend/crypt/crypt_config_test.go b/backend/crypt/crypt_config_test.go
index 84e79dc05..b6725a5f8 100644
--- a/backend/crypt/crypt_config_test.go
+++ b/backend/crypt/crypt_config_test.go
@@ -4,7 +4,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fstest/fstests"
 )
 
@@ -19,15 +19,15 @@ func init() {
 	fstests.ExtraConfig = []fstests.ExtraConfigItem{
 		{Name: name, Key: "type", Value: "crypt"},
 		{Name: name, Key: "remote", Value: tempdir},
-		{Name: name, Key: "password", Value: config.MustObscure("potato")},
+		{Name: name, Key: "password", Value: obscure.MustObscure("potato")},
 		{Name: name, Key: "filename_encryption", Value: "standard"},
 		{Name: name2, Key: "type", Value: "crypt"},
 		{Name: name2, Key: "remote", Value: tempdir2},
-		{Name: name2, Key: "password", Value: config.MustObscure("potato2")},
+		{Name: name2, Key: "password", Value: obscure.MustObscure("potato2")},
 		{Name: name2, Key: "filename_encryption", Value: "off"},
 		{Name: name3, Key: "type", Value: "crypt"},
 		{Name: name3, Key: "remote", Value: tempdir3},
-		{Name: name3, Key: "password", Value: config.MustObscure("potato2")},
+		{Name: name3, Key: "password", Value: obscure.MustObscure("potato2")},
 		{Name: name3, Key: "filename_encryption", Value: "obfuscate"},
 	}
 	fstests.SkipBadWindowsCharacters[name3+":"] = true
diff --git a/backend/drive/drive.go b/backend/drive/drive.go
index ef0c2876b..7020bc9cb 100644
--- a/backend/drive/drive.go
+++ b/backend/drive/drive.go
@@ -23,6 +23,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/fs/hash"
@@ -66,7 +67,7 @@ var (
 		Scopes:       []string{"https://www.googleapis.com/auth/drive"},
 		Endpoint:     google.Endpoint,
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.TitleBarRedirectURL,
 	}
 	mimeTypeToExtension = map[string]string{
diff --git a/backend/dropbox/dropbox.go b/backend/dropbox/dropbox.go
index 35be7b901..0c91d5f63 100644
--- a/backend/dropbox/dropbox.go
+++ b/backend/dropbox/dropbox.go
@@ -39,6 +39,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/lib/oauthutil"
@@ -67,7 +68,7 @@ var (
 		// },
 		Endpoint:     dropbox.OAuthEndpoint(""),
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectLocalhostURL,
 	}
 	// A regexp matching path names for files Dropbox ignores
diff --git a/backend/ftp/ftp.go b/backend/ftp/ftp.go
index 931dcf2af..7e84ae671 100644
--- a/backend/ftp/ftp.go
+++ b/backend/ftp/ftp.go
@@ -14,6 +14,7 @@ import (
 	"github.com/jlaffaye/ftp"
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/pkg/errors"
 )
@@ -188,7 +189,7 @@ func NewFs(name, root string) (ff fs.Fs, err error) {
 	user := config.FileGet(name, "user")
 	pass := config.FileGet(name, "pass")
 	port := config.FileGet(name, "port")
-	pass, err = config.Reveal(pass)
+	pass, err = obscure.Reveal(pass)
 	if err != nil {
 		return nil, errors.Wrap(err, "NewFS decrypt password")
 	}
diff --git a/backend/googlecloudstorage/googlecloudstorage.go b/backend/googlecloudstorage/googlecloudstorage.go
index 72faa7e9f..426f31ab4 100644
--- a/backend/googlecloudstorage/googlecloudstorage.go
+++ b/backend/googlecloudstorage/googlecloudstorage.go
@@ -30,6 +30,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/fs/walk"
@@ -58,7 +59,7 @@ var (
 		Scopes:       []string{storage.DevstorageFullControlScope},
 		Endpoint:     google.Endpoint,
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.TitleBarRedirectURL,
 	}
 )
diff --git a/backend/hubic/hubic.go b/backend/hubic/hubic.go
index 4e0ca3051..43291d425 100644
--- a/backend/hubic/hubic.go
+++ b/backend/hubic/hubic.go
@@ -16,6 +16,7 @@ import (
 	"github.com/ncw/rclone/backend/swift"
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/lib/oauthutil"
 	swiftLib "github.com/ncw/swift"
@@ -40,7 +41,7 @@ var (
 			TokenURL: "https://api.hubic.com/oauth/token/",
 		},
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectLocalhostURL,
 	}
 )
diff --git a/backend/onedrive/onedrive.go b/backend/onedrive/onedrive.go
index 1acbebe78..b36008149 100644
--- a/backend/onedrive/onedrive.go
+++ b/backend/onedrive/onedrive.go
@@ -18,6 +18,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/lib/dircache"
@@ -56,7 +57,7 @@ var (
 			TokenURL: "https://login.live.com/oauth20_token.srf",
 		},
 		ClientID:     rclonePersonalClientID,
-		ClientSecret: config.MustReveal(rclonePersonalEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rclonePersonalEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectLocalhostURL,
 	}
 
@@ -67,7 +68,7 @@ var (
 			TokenURL: "https://login.microsoftonline.com/common/oauth2/token",
 		},
 		ClientID:     rcloneBusinessClientID,
-		ClientSecret: config.MustReveal(rcloneBusinessEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneBusinessEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectLocalhostURL,
 	}
 	oauthBusinessResource = oauth2.SetAuthURLParam("resource", discoveryServiceURL)
diff --git a/backend/pcloud/pcloud.go b/backend/pcloud/pcloud.go
index d30980763..e8b4ae97d 100644
--- a/backend/pcloud/pcloud.go
+++ b/backend/pcloud/pcloud.go
@@ -25,6 +25,7 @@ import (
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
 	"github.com/ncw/rclone/fs/config/flags"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/lib/dircache"
@@ -55,7 +56,7 @@ var (
 			TokenURL: "https://api.pcloud.com/oauth2_token",
 		},
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectLocalhostURL,
 	}
 	uploadCutoff = fs.SizeSuffix(50 * 1024 * 1024)
diff --git a/backend/sftp/sftp.go b/backend/sftp/sftp.go
index 9460ca056..907047fe2 100644
--- a/backend/sftp/sftp.go
+++ b/backend/sftp/sftp.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/pkg/errors"
@@ -318,7 +319,7 @@ func NewFs(name, root string) (fs.Fs, error) {
 
 	// Auth from password if specified
 	if pass != "" {
-		clearpass, err := config.Reveal(pass)
+		clearpass, err := obscure.Reveal(pass)
 		if err != nil {
 			return nil, err
 		}
diff --git a/backend/webdav/webdav.go b/backend/webdav/webdav.go
index e4a3d264e..462a6652e 100644
--- a/backend/webdav/webdav.go
+++ b/backend/webdav/webdav.go
@@ -31,6 +31,7 @@ import (
 	"github.com/ncw/rclone/backend/webdav/api"
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fserrors"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/fs/hash"
@@ -260,7 +261,7 @@ func NewFs(name, root string) (fs.Fs, error) {
 	pass := config.FileGet(name, "pass")
 	if pass != "" {
 		var err error
-		pass, err = config.Reveal(pass)
+		pass, err = obscure.Reveal(pass)
 		if err != nil {
 			return nil, errors.Wrap(err, "couldn't decrypt password")
 		}
diff --git a/backend/yandex/yandex.go b/backend/yandex/yandex.go
index 9586f0745..3b621c788 100644
--- a/backend/yandex/yandex.go
+++ b/backend/yandex/yandex.go
@@ -16,6 +16,7 @@ import (
 	yandex "github.com/ncw/rclone/backend/yandex/api"
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/ncw/rclone/fs/hash"
 	"github.com/ncw/rclone/lib/oauthutil"
@@ -39,7 +40,7 @@ var (
 			TokenURL: "https://oauth.yandex.com/token",     //same as https://oauth.yandex.ru/token
 		},
 		ClientID:     rcloneClientID,
-		ClientSecret: config.MustReveal(rcloneEncryptedClientSecret),
+		ClientSecret: obscure.MustReveal(rcloneEncryptedClientSecret),
 		RedirectURL:  oauthutil.RedirectURL,
 	}
 )
diff --git a/cmd/obscure/obscure.go b/cmd/obscure/obscure.go
index 084c2c98d..1b07ce2c5 100644
--- a/cmd/obscure/obscure.go
+++ b/cmd/obscure/obscure.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	"github.com/ncw/rclone/cmd"
-	"github.com/ncw/rclone/fs/config"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/spf13/cobra"
 )
 
@@ -18,8 +18,8 @@ var commandDefintion = &cobra.Command{
 	Run: func(command *cobra.Command, args []string) {
 		cmd.CheckArgs(1, 1, command, args)
 		cmd.Run(false, false, command, func() error {
-			obscure := config.MustObscure(args[0])
-			fmt.Println(obscure)
+			obscured := obscure.MustObscure(args[0])
+			fmt.Println(obscured)
 			return nil
 		})
 	},
diff --git a/fs/config/config.go b/fs/config/config.go
index 40a3951b4..c81c9a557 100644
--- a/fs/config/config.go
+++ b/fs/config/config.go
@@ -25,6 +25,7 @@ import (
 	"github.com/Unknwon/goconfig"
 	"github.com/ncw/rclone/fs"
 	"github.com/ncw/rclone/fs/accounting"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/ncw/rclone/fs/driveletter"
 	"github.com/ncw/rclone/fs/fshttp"
 	"github.com/pkg/errors"
@@ -694,7 +695,7 @@ func ChooseOption(o *fs.Option) string {
 		default:
 			fs.Errorf(nil, "Bad choice %c", i)
 		}
-		return MustObscure(password)
+		return obscure.MustObscure(password)
 	}
 	if len(o.Examples) > 0 {
 		var values []string
@@ -749,7 +750,7 @@ func PasswordRemote(name string, keyValues []string) error {
 	}
 	// Suppress Confirm
 	fs.Config.AutoConfirm = true
-	passwd := MustObscure(keyValues[1])
+	passwd := obscure.MustObscure(keyValues[1])
 	if passwd != "" {
 		configData.SetValue(name, keyValues[0], passwd)
 		RemoteConfig(name)
diff --git a/fs/config/config_test.go b/fs/config/config_test.go
index c97ee434e..fa63c918a 100644
--- a/fs/config/config_test.go
+++ b/fs/config/config_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/ncw/rclone/fs"
+	"github.com/ncw/rclone/fs/config/obscure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -89,7 +90,7 @@ func TestReveal(t *testing.T) {
 		{"aGVsbG8", "input too short when revealing password - is it obscured?"},
 		{"", "input too short when revealing password - is it obscured?"},
 	} {
-		gotString, gotErr := Reveal(test.in)
+		gotString, gotErr := obscure.Reveal(test.in)
 		assert.Equal(t, "", gotString)
 		assert.Equal(t, test.wantErr, gotErr.Error())
 	}
diff --git a/fs/config/obscure.go b/fs/config/obscure/obscure.go
similarity index 96%
rename from fs/config/obscure.go
rename to fs/config/obscure/obscure.go
index 7db600141..2f2261f3d 100644
--- a/fs/config/obscure.go
+++ b/fs/config/obscure/obscure.go
@@ -1,6 +1,5 @@
-// Obscure and Reveal config values
-
-package config
+// Package obscure contains the Obscure and Reveal commands
+package obscure
 
 import (
 	"crypto/aes"
diff --git a/fs/config/obscure_test.go b/fs/config/obscure/obscure_test.go
similarity index 98%
rename from fs/config/obscure_test.go
rename to fs/config/obscure/obscure_test.go
index 90d76e628..a2d465cde 100644
--- a/fs/config/obscure_test.go
+++ b/fs/config/obscure/obscure_test.go
@@ -1,4 +1,4 @@
-package config
+package obscure
 
 import (
 	"bytes"