diff --git a/hgext/fetch.py b/hgext/fetch.py
--- a/hgext/fetch.py
+++ b/hgext/fetch.py
@@ -43,7 +43,8 @@ def fetch(ui, repo, source='default', **
         if not err:
             mod, add, rem = repo.status()[:3]
             message = (cmdutil.logmessage(opts) or
-                       (_('Automated merge with %s') % other.url()))
+                       (_('Automated merge with %s') %
+                        util.removeauth(other.url())))
             n = repo.commit(mod + add + rem, message,
                             opts['user'], opts['date'],
                             force_editor=opts.get('force_editor'))
@@ -54,7 +55,8 @@ def fetch(ui, repo, source='default', **
         cmdutil.setremoteconfig(ui, opts)
 
         other = hg.repository(ui, ui.expandpath(source))
-        ui.status(_('pulling from %s\n') % ui.expandpath(source))
+        ui.status(_('pulling from %s\n') %
+                  util.hidepassword(ui.expandpath(source)))
         revs = None
         if opts['rev'] and not other.local():
             raise util.Abort(_("fetch -r doesn't work for remote repositories yet"))
diff --git a/mercurial/util.py b/mercurial/util.py
--- a/mercurial/util.py
+++ b/mercurial/util.py
@@ -1707,32 +1707,14 @@ def uirepr(s):
     # Avoid double backslash in Windows path repr()
     return repr(s).replace('\\\\', '\\')
 
-def hidepassword(url):
-    '''replaces the password in the url string by three asterisks (***)
+def hidepassword(url, user=True, password=True):
+    '''hide user credential in a url string'''
+    scheme, netloc, path, params, query, fragment = urlparse.urlparse(url)
+    netloc = re.sub('([^:]*):([^@]*)@(.*)', r'\1:***@\3', netloc)
+    return urlparse.urlunparse((scheme, netloc, path, params, query, fragment))
 
-    >>> hidepassword('http://www.example.com/some/path#fragment')
-    'http://www.example.com/some/path#fragment'
-    >>> hidepassword('http://me@www.example.com/some/path#fragment')
-    'http://me@www.example.com/some/path#fragment'
-    >>> hidepassword('http://me:simplepw@www.example.com/path#frag')
-    'http://me:***@www.example.com/path#frag'
-    >>> hidepassword('http://me:complex:pw@www.example.com/path#frag')
-    'http://me:***@www.example.com/path#frag'
-    >>> hidepassword('/path/to/repo')
-    '/path/to/repo'
-    >>> hidepassword('relative/path/to/repo')
-    'relative/path/to/repo'
-    >>> hidepassword('c:\\\\path\\\\to\\\\repo')
-    'c:\\\\path\\\\to\\\\repo'
-    >>> hidepassword('c:/path/to/repo')
-    'c:/path/to/repo'
-    >>> hidepassword('bundle://path/to/bundle')
-    'bundle://path/to/bundle'
-    '''
-    url_parts = list(urlparse.urlparse(url))
-    host_with_pw_pattern = re.compile('^([^:]*):([^@]*)@(.*)$')
-    if host_with_pw_pattern.match(url_parts[1]):
-        url_parts[1] = re.sub(host_with_pw_pattern, r'\1:***@\3',
-            url_parts[1])
-    return urlparse.urlunparse(url_parts)
-
+def removeauth(url):
+    '''remove all authentication information from a url string'''
+    scheme, netloc, path, params, query, fragment = urlparse.urlparse(url)
+    netloc = netloc[netloc.find('@')+1:]
+    return urlparse.urlunparse((scheme, netloc, path, params, query, fragment))
diff --git a/tests/test-fetch b/tests/test-fetch
--- a/tests/test-fetch
+++ b/tests/test-fetch
@@ -20,5 +20,20 @@ hg --cwd b parents -q
 
 echo c > c/c
 hg --cwd c commit -d '3 0' -Amc
+
+hg clone c d
+hg clone c e
+
 hg --cwd c fetch -d '4 0' -m 'automated merge' ../a
 ls c
+
+hg --cwd a serve -a localhost -p $HGPORT -d --pid-file=hg.pid
+cat a/hg.pid >> "$DAEMON_PIDS"
+
+echo '% fetch over http, no auth'
+hg --cwd d fetch -d '5 0' http://localhost:$HGPORT/
+hg --cwd d tip --template '{desc}\n'
+
+echo '% fetch over http with auth (should be hidden in desc)'
+hg --cwd e fetch -d '5 0' http://user:password@localhost:$HGPORT/
+hg --cwd e tip --template '{desc}\n'
diff --git a/tests/test-fetch.out b/tests/test-fetch.out
--- a/tests/test-fetch.out
+++ b/tests/test-fetch.out
@@ -13,6 +13,8 @@ added 1 changesets with 1 changes to 1 f
 1 files updated, 0 files merged, 0 files removed, 0 files unresolved
 1:97d72e5f12c7
 adding c
+2 files updated, 0 files merged, 0 files removed, 0 files unresolved
+2 files updated, 0 files merged, 0 files removed, 0 files unresolved
 pulling from ../a
 searching for changes
 adding changesets
@@ -25,3 +27,25 @@ new changeset 3:cd3a41621cf0 merges remo
 a
 b
 c
+% fetch over http, no auth
+pulling from http://localhost:20059/
+searching for changes
+adding changesets
+adding manifests
+adding file changes
+added 1 changesets with 1 changes to 1 files (+1 heads)
+merging with new head 2:97d72e5f12c7
+1 files updated, 0 files merged, 0 files removed, 0 files unresolved
+new changeset 3:0b6439e938f9 merges remote changes with local
+Automated merge with http://localhost:20059/
+% fetch over http with auth (should be hidden in desc)
+pulling from http://user:***@localhost:20059/
+searching for changes
+adding changesets
+adding manifests
+adding file changes
+added 1 changesets with 1 changes to 1 files (+1 heads)
+merging with new head 2:97d72e5f12c7
+1 files updated, 0 files merged, 0 files removed, 0 files unresolved
+new changeset 3:0b6439e938f9 merges remote changes with local
+Automated merge with http://localhost:20059/