diff --git a/lib/util/settings.js b/lib/util/settings.js
index c79772596..323eae54c 100644
--- a/lib/util/settings.js
+++ b/lib/util/settings.js
@@ -277,6 +277,24 @@ function validate() {
 function read() {
     const s = yaml.read(file);
 
+    // Read !secret MQTT username and password if set
+    const interpetValue = (value) => {
+        const re = /!(.*) (.*)/g;
+        const match = re.exec(value);
+        if (match) {
+            const file = data.joinPath(`${match[1]}.yaml`);
+            const key = match[2];
+            return yaml.read(file)[key];
+        } else {
+            return value;
+        }
+    };
+
+    if (s.mqtt && s.mqtt.user && s.mqtt.password) {
+        s.mqtt.user = interpetValue(s.mqtt.user);
+        s.mqtt.password = interpetValue(s.mqtt.password);
+    }
+
     // Read devices/groups configuration from separate file.
     if (typeof s.devices === 'string') {
         const file = data.joinPath(s.devices);
diff --git a/test/settings.test.js b/test/settings.test.js
index 7d8d0e048..9c2c76541 100644
--- a/test/settings.test.js
+++ b/test/settings.test.js
@@ -6,12 +6,15 @@ const fs = require('fs');
 const configurationFile = data.joinPath('configuration.yaml');
 const devicesFile = data.joinPath('devices.yaml');
 const groupsFile = data.joinPath('groups.yaml');
+const secretFile = data.joinPath('secret.yaml');
 const yaml = require('js-yaml');
 
 describe('Settings', () => {
-    const write = (file, json) => {
+    const write = (file, json, reread=true) => {
         fs.writeFileSync(file, yaml.safeDump(json))
-        settings._reRead();
+        if (reread) {
+            settings._reRead();
+        }
     };
     const read = (file) => yaml.safeLoad(fs.readFileSync(file, 'utf8'));
     const remove = (file) => {
@@ -89,6 +92,33 @@ describe('Settings', () => {
         settings.getDevice('0x12345678');
     });
 
+    it('onlythis Should read MQTT username asn password form a separate file', () => {
+        const contentConfiguration = {
+            mqtt: {
+                server: 'my.mqtt.server',
+                user: '!secret username',
+                password: '!secret password',
+            },
+        };
+
+        const contentSecret = {
+            username: 'mysecretusername',
+            password: 'mysecretpassword',
+        };
+
+        write(secretFile, contentSecret, false);
+        write(configurationFile, contentConfiguration);
+
+        const expected = {
+            include_device_information: false,
+            password: "mysecretpassword",
+            server: "my.mqtt.server",
+            user: "mysecretusername",
+        };
+
+        expect(settings.get().mqtt).toStrictEqual(expected);
+    });
+
     it('Should read devices form a separate file', () => {
         const contentConfiguration = {
             devices: 'devices.yaml',