diff --git a/app/src/main/kotlin/dev/injun/remotesync/data/config/ConfigRepository.kt b/app/src/main/kotlin/dev/injun/remotesync/data/config/ConfigRepository.kt
index 11d3aaa..4c1c702 100644
--- a/app/src/main/kotlin/dev/injun/remotesync/data/config/ConfigRepository.kt
+++ b/app/src/main/kotlin/dev/injun/remotesync/data/config/ConfigRepository.kt
@@ -228,7 +228,7 @@ class ConfigRepository @Inject constructor(
             remote = when (protocol) {
                 Protocol.SMB -> SmbConfig(
                     host = o.optString("host"),
-                    port = o.optInt("port", 445),
+                    port = o.optInt("port", SmbConfig.DEFAULT_PORT),
                     shareName = o.optString("share"),
                     domain = o.optString("domain"),
                     username = o.optString("user"),
@@ -255,7 +255,7 @@ class ConfigRepository @Inject constructor(
             localRoot = prefs.getString("local_root", "").orEmpty(),
             remote = SmbConfig(
                 host = prefs.getString("smb_host", "").orEmpty(),
-                port = prefs.getInt("smb_port", 445),
+                port = prefs.getInt("smb_port", SmbConfig.DEFAULT_PORT),
                 shareName = prefs.getString("smb_share", "").orEmpty(),
                 domain = prefs.getString("smb_domain", "").orEmpty(),
                 username = prefs.getString("smb_user", "").orEmpty(),
diff --git a/app/src/main/kotlin/dev/injun/remotesync/sync/RemoteConfig.kt b/app/src/main/kotlin/dev/injun/remotesync/sync/RemoteConfig.kt
index 836ee41..27fb947 100644
--- a/app/src/main/kotlin/dev/injun/remotesync/sync/RemoteConfig.kt
+++ b/app/src/main/kotlin/dev/injun/remotesync/sync/RemoteConfig.kt
@@ -16,7 +16,7 @@ sealed interface RemoteConfig {
 /** SMB connection details. [rootPath] is the sub-directory within the share ("" = share root). */
 data class SmbConfig(
     val host: String,
-    val port: Int = 445,
+    val port: Int = DEFAULT_PORT,
     val shareName: String,
     val domain: String = "",
     val username: String,
@@ -27,4 +27,15 @@ data class SmbConfig(
     override val displayPath: String
         get() = "$host/$shareName" + if (rootPath.isBlank()) "" else "/$rootPath"
     override fun withoutSecrets(): RemoteConfig = copy(password = "")
+
+    // Redact the password so an accidental log/exception dump of a config or its
+    // enclosing SyncPair never leaks the plaintext secret.
+    override fun toString(): String =
+        "SmbConfig(host=$host, port=$port, shareName=$shareName, domain=$domain, " +
+            "username=$username, password=${if (password.isEmpty()) "" else "***"}, rootPath=$rootPath)"
+
+    companion object {
+        /** Standard SMB (microsoft-ds) port; default when the user leaves it blank. */
+        const val DEFAULT_PORT = 445
+    }
 }
diff --git a/app/src/main/kotlin/dev/injun/remotesync/ui/screens/SetupScreen.kt b/app/src/main/kotlin/dev/injun/remotesync/ui/screens/SetupScreen.kt
index c5a8844..4524ca3 100644
--- a/app/src/main/kotlin/dev/injun/remotesync/ui/screens/SetupScreen.kt
+++ b/app/src/main/kotlin/dev/injun/remotesync/ui/screens/SetupScreen.kt
@@ -171,7 +171,7 @@ private fun rememberSmbFormState(existing: SmbConfig?): SmbFormState =
 
 private class SmbFormState(existing: SmbConfig?) : RemoteFormState {
     var host by mutableStateOf(existing?.host ?: "")
-    var port by mutableStateOf((existing?.port ?: 445).toString())
+    var port by mutableStateOf((existing?.port ?: SmbConfig.DEFAULT_PORT).toString())
     var share by mutableStateOf(existing?.shareName ?: "")
     var domain by mutableStateOf(existing?.domain ?: "")
     var user by mutableStateOf(existing?.username ?: "")
@@ -185,7 +185,7 @@ private class SmbFormState(existing: SmbConfig?) : RemoteFormState {
 
     override fun build(): RemoteConfig = SmbConfig(
         host = host.trim(),
-        port = port.toIntOrNull() ?: 445,
+        port = port.toIntOrNull() ?: SmbConfig.DEFAULT_PORT,
         shareName = share.trim(),
         domain = domain.trim(),
         username = user.trim(),