diff --git a/nifi/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/controller/ControllerFacade.java b/nifi/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/controller/ControllerFacade.java
index dbc4b3c6f3..2a68016d2c 100644
--- a/nifi/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/controller/ControllerFacade.java
+++ b/nifi/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/controller/ControllerFacade.java
@@ -1175,13 +1175,19 @@ public class ControllerFacade implements ControllerServiceProvider {
 
         for (final Map.Entry<PropertyDescriptor, String> entry : procNode.getProperties().entrySet()) {
             final PropertyDescriptor descriptor = entry.getKey();
+            
+            addIfAppropriate(searchStr, descriptor.getName(), "Property", matches);
+            addIfAppropriate(searchStr, descriptor.getDescription(), "Property", matches);
+            
+            // never include sensitive properties values in search results
+            if (descriptor.isSensitive()) {
+                continue;
+            }
+            
             final String value = entry.getValue();
             if (StringUtils.containsIgnoreCase(value, searchStr)) {
                 matches.add("Property: " + descriptor.getName() + " - " + value);
             }
-
-            addIfAppropriate(searchStr, descriptor.getName(), "Property", matches);
-            addIfAppropriate(searchStr, descriptor.getDescription(), "Property", matches);
         }
 
         // consider searching the processor directly