diff --git a/Makefile b/Makefile
index e5855f3..c24e130 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,9 @@ fmt: tb.golines tb.gofumpt
 # Run tests
 test: generate fmt lint test-ci
 
+fuzz:
+	 go test -fuzz=FuzzMask -v ./pkg/types/ -fuzztime=60s
+
 # Run ci tests
 test-ci: mocks tidy tb.ginkgo
 	$(TB_GINKGO) --cover --coverprofile coverage.out.tmp ./...
diff --git a/pkg/types/types.go b/pkg/types/types.go
index 6b706fb..764506c 100644
--- a/pkg/types/types.go
+++ b/pkg/types/types.go
@@ -187,8 +187,8 @@ func (i *AdGuardInstance) Init() error {
 }
 
 func mask(s string) string {
-	if s == "" {
-		return "***"
+	if len(s) < 3 {
+		return strings.Repeat("*", len(s))
 	}
 	mask := strings.Repeat("*", len(s)-2)
 	return fmt.Sprintf("%v%s%v", string(s[0]), mask, string(s[len(s)-1]))
diff --git a/pkg/types/types_fuzz_test.go b/pkg/types/types_fuzz_test.go
new file mode 100644
index 0000000..7b8d476
--- /dev/null
+++ b/pkg/types/types_fuzz_test.go
@@ -0,0 +1,15 @@
+package types
+
+import (
+	"testing"
+)
+
+func FuzzMask(f *testing.F) {
+	testcases := []string{"", "a", "ab", "abc", "abcd"}
+	for _, tc := range testcases {
+		f.Add(tc)
+	}
+	f.Fuzz(func(t *testing.T, value string) {
+		_ = mask(value)
+	})
+}
diff --git a/pkg/types/types_test.go b/pkg/types/types_test.go
index 405ee03..ec003db 100644
--- a/pkg/types/types_test.go
+++ b/pkg/types/types_test.go
@@ -83,6 +83,15 @@ var _ = Describe("Types", func() {
 				Ω(masked.API.Password).Should(Equal("p**s"))
 			})
 		})
+		DescribeTable("mask should work correctly",
+			func(value, expected string) {
+				Ω(mask(value)).Should(Equal(expected))
+			},
+			Entry(`Empty password`, "", ""),
+			Entry(`1 char password`, "a", "*"),
+			Entry(`2 char password`, "ab", "**"),
+			Entry(`3 char password`, "abc", "a*c"),
+		)
 	})
 	Context("Feature", func() {
 		Context("LogDisabled", func() {