diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 84a4310..35fc3da 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -1945,6 +1945,9 @@
 
 [sendemail]
   smtpPass = sp@m
+
+[remote "bar"]
+  password = s3kr3t
 ----
 
 File `etc/replication.config`
diff --git a/Documentation/config-replication.txt b/Documentation/config-replication.txt
index 81fda98..53c69a5 100644
--- a/Documentation/config-replication.txt
+++ b/Documentation/config-replication.txt
@@ -194,6 +194,24 @@
 everything to all remotes.
 
 
+[[secure_config]]File `secure.config`
+-----------------------------------------------
+
+The optional file `'$site_path'/secure.config` is a Git-style config
+file that provides secure values that should not be world-readable,
+such as passwords. Passwords for HTTP remotes can be obtained from
+this file.
+
+[[remote.name.username]]remote.<name>.username::
++
+Username to use for HTTP authentication on this remote, if not given
+in the URL.
+
+[[remote.name.password]]remote.<name>.password::
++
+Password to use for HTTP authentication on this remote.
+
+
 [[ssh_config]]File `~/.ssh/config`
 ----------------------------------
 
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/config/GerritGlobalModule.java b/gerrit-server/src/main/java/com/google/gerrit/server/config/GerritGlobalModule.java
index df10c27..5426f34 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/config/GerritGlobalModule.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/config/GerritGlobalModule.java
@@ -19,7 +19,6 @@
 import com.google.gerrit.common.data.ApprovalTypes;
 import com.google.gerrit.lifecycle.LifecycleListener;
 import com.google.gerrit.lifecycle.LifecycleModule;
-import com.google.gerrit.reviewdb.AccountGroup;
 import com.google.gerrit.reviewdb.AuthType;
 import com.google.gerrit.reviewdb.Project;
 import com.google.gerrit.server.AnonymousUser;
@@ -35,12 +34,11 @@
 import com.google.gerrit.server.account.DefaultRealm;
 import com.google.gerrit.server.account.EmailExpander;
 import com.google.gerrit.server.account.GroupCacheImpl;
-import com.google.gerrit.server.account.GroupInfoCacheFactory;
 import com.google.gerrit.server.account.GroupIncludeCacheImpl;
+import com.google.gerrit.server.account.GroupInfoCacheFactory;
 import com.google.gerrit.server.account.Realm;
 import com.google.gerrit.server.auth.ldap.LdapModule;
 import com.google.gerrit.server.cache.CachePool;
-import com.google.gerrit.server.config.SitePaths;
 import com.google.gerrit.server.events.EventFactory;
 import com.google.gerrit.server.git.ChangeMergeQueue;
 import com.google.gerrit.server.git.GitRepositoryManager;
@@ -50,6 +48,7 @@
 import com.google.gerrit.server.git.PushReplication;
 import com.google.gerrit.server.git.ReloadSubmitQueueOp;
 import com.google.gerrit.server.git.ReplicationQueue;
+import com.google.gerrit.server.git.SecureCredentialsProvider;
 import com.google.gerrit.server.git.TransferConfig;
 import com.google.gerrit.server.git.WorkQueue;
 import com.google.gerrit.server.mail.EmailSender;
@@ -68,16 +67,13 @@
 import com.google.gerrit.server.util.IdGenerator;
 import com.google.gerrit.server.workflow.FunctionState;
 import com.google.inject.Inject;
-import com.google.inject.TypeLiteral;
 
 import org.apache.velocity.app.Velocity;
 import org.apache.velocity.runtime.RuntimeConstants;
-
 import org.eclipse.jgit.lib.Config;
 import org.eclipse.jgit.lib.PersonIdent;
 
 import java.util.Properties;
-import java.util.Set;
 
 
 /** Starts global state with standard dependencies. */
@@ -173,6 +169,7 @@
     bind(TransferConfig.class);
 
     bind(ReplicationQueue.class).to(PushReplication.class).in(SINGLETON);
+    factory(SecureCredentialsProvider.Factory.class);
     factory(PushAllProjectsOp.Factory.class);
 
     bind(MergeQueue.class).to(ChangeMergeQueue.class).in(SINGLETON);
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/git/PushOp.java b/gerrit-server/src/main/java/com/google/gerrit/server/git/PushOp.java
index 049e0e0..a24d416 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/git/PushOp.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/git/PushOp.java
@@ -15,8 +15,8 @@
 package com.google.gerrit.server.git;
 
 import com.google.gerrit.reviewdb.Project;
-import com.google.gerrit.reviewdb.ReviewDb;
 import com.google.gerrit.reviewdb.Project.NameKey;
+import com.google.gerrit.reviewdb.ReviewDb;
 import com.google.gerrit.server.project.NoSuchProjectException;
 import com.google.gerrit.server.project.ProjectControl;
 import com.google.gwtorm.client.OrmException;
@@ -34,6 +34,7 @@
 import org.eclipse.jgit.lib.NullProgressMonitor;
 import org.eclipse.jgit.lib.Ref;
 import org.eclipse.jgit.lib.Repository;
+import org.eclipse.jgit.transport.CredentialsProvider;
 import org.eclipse.jgit.transport.FetchConnection;
 import org.eclipse.jgit.transport.PushResult;
 import org.eclipse.jgit.transport.RefSpec;
@@ -70,6 +71,7 @@
   private final SchemaFactory<ReviewDb> schema;
   private final PushReplication.ReplicationConfig pool;
   private final RemoteConfig config;
+  private final CredentialsProvider credentialsProvider;
 
   private final Set<String> delta = new HashSet<String>();
   private final Project.NameKey projectName;
@@ -88,11 +90,13 @@
   @Inject
   PushOp(final GitRepositoryManager grm, final SchemaFactory<ReviewDb> s,
       final PushReplication.ReplicationConfig p, final RemoteConfig c,
+      final SecureCredentialsProvider.Factory cpFactory,
       @Assisted final Project.NameKey d, @Assisted final URIish u) {
     repoManager = grm;
     schema = s;
     pool = p;
     config = c;
+    credentialsProvider = cpFactory.create(c.getName());
     projectName = d;
     uri = u;
   }
@@ -249,6 +253,7 @@
   private PushResult pushVia(final Transport tn) throws IOException,
       NotSupportedException, TransportException {
     tn.applyConfig(config);
+    tn.setCredentialsProvider(credentialsProvider);
 
     final List<RemoteRefUpdate> todo = generateUpdates(tn);
     if (todo.isEmpty()) {
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/git/SecureCredentialsProvider.java b/gerrit-server/src/main/java/com/google/gerrit/server/git/SecureCredentialsProvider.java
new file mode 100644
index 0000000..d51936a
--- /dev/null
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/git/SecureCredentialsProvider.java
@@ -0,0 +1,92 @@
+// Copyright (C) 2011 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.git;
+
+import com.google.gerrit.server.config.GerritServerConfig;
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+
+import org.eclipse.jgit.errors.UnsupportedCredentialItem;
+import org.eclipse.jgit.lib.Config;
+import org.eclipse.jgit.transport.CredentialItem;
+import org.eclipse.jgit.transport.CredentialsProvider;
+import org.eclipse.jgit.transport.URIish;
+
+/** Looks up a remote's password in secure.config. */
+public class SecureCredentialsProvider extends CredentialsProvider {
+  public interface Factory {
+    SecureCredentialsProvider create(String remoteName);
+  }
+
+  private final String cfgUser;
+  private final String cfgPass;
+
+  @Inject
+  SecureCredentialsProvider(@GerritServerConfig Config cfg,
+      @Assisted String remoteName) {
+    cfgUser = cfg.getString("remote", remoteName, "username");
+    cfgPass = cfg.getString("remote", remoteName, "password");
+  }
+
+  @Override
+  public boolean isInteractive() {
+    return false;
+  }
+
+  @Override
+  public boolean supports(CredentialItem... items) {
+    for (CredentialItem i : items) {
+      if (i instanceof CredentialItem.Username) {
+        continue;
+      } else if (i instanceof CredentialItem.Password) {
+        continue;
+      } else {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  @Override
+  public boolean get(URIish uri, CredentialItem... items)
+      throws UnsupportedCredentialItem {
+    String username = uri.getUser();
+    if (username == null) {
+      username = cfgUser;
+    }
+    if (username == null) {
+      return false;
+    }
+
+    String password = uri.getPass();
+    if (password == null) {
+      password = cfgPass;
+    }
+    if (password == null) {
+      return false;
+    }
+
+    for (CredentialItem i : items) {
+      if (i instanceof CredentialItem.Username) {
+        ((CredentialItem.Username) i).setValue(username);
+      } else if (i instanceof CredentialItem.Password) {
+        ((CredentialItem.Password) i).setValue(password.toCharArray());
+      } else {
+        throw new UnsupportedCredentialItem(uri, i.getPromptText());
+      }
+    }
+    return true;
+  }
+}