diff --git a/x-pack/docs/en/watcher/actions/email.asciidoc b/x-pack/docs/en/watcher/actions/email.asciidoc
index 96839b972be..37cd8450850 100644
--- a/x-pack/docs/en/watcher/actions/email.asciidoc
+++ b/x-pack/docs/en/watcher/actions/email.asciidoc
@@ -318,7 +318,14 @@ xpack.notification.email.account:
             host: smtp.gmail.com
             port: 587
             user: <username>
-            password: <password>
+--------------------------------------------------
+
+In order to store the account SMTP password, use the keystore command
+(see {ref}/secure-settings.html[secure settings])
+
+[source,yaml]
+--------------------------------------------------
+bin/elasticsearch-keystore xpack.notification.email.account.gmail_account.smtp.secure_password
 --------------------------------------------------
 
 If you get an authentication error that indicates that you need to continue the
@@ -349,9 +356,17 @@ xpack.notification.email.account:
             host: smtp-mail.outlook.com
             port: 587
             user: <email.address>
-            password: <password>
 --------------------------------------------------
 
+In order to store the account SMTP password, use the keystore command
+(see {ref}/secure-settings.html[secure settings])
+
+[source,yaml]
+--------------------------------------------------
+bin/elasticsearch-keystore xpack.notification.email.account.outlook_account.smtp.secure_password
+--------------------------------------------------
+
+
 When sending emails, you have to provide a from address, either a default one
 in your account configuration or as part of the email action in the watch.
 
@@ -377,10 +392,17 @@ xpack.notification.email.account:
             host: email-smtp.us-east-1.amazonaws.com <1>
             port: 587
             user: <username>
-            password: <password>
 --------------------------------------------------
 <1> `smtp.host` varies depending on the region
 
+In order to store the account SMTP password, use the keystore command
+(see {ref}/secure-settings.html[secure settings])
+
+[source,yaml]
+--------------------------------------------------
+bin/elasticsearch-keystore xpack.notification.email.account.ses_account.smtp.secure_password
+--------------------------------------------------
+
 NOTE:   You need to use your Amazon SES SMTP credentials to send email through
         Amazon SES. For more information, see
         http://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html[Obtaining
@@ -409,7 +431,6 @@ xpack.notification.email.account:
             host: <your exchange server>
             port: 587
             user: <email address of service account> <2>
-            password: <password>
 --------------------------------------------------
 <1> Some organizations configure Exchange to validate that the `from` field is a
     valid local email account.
@@ -417,6 +438,13 @@ xpack.notification.email.account:
     it is a good idea to check with your system administrator if you receive
     authentication-related failures.
 
+In order to store the account SMTP password, use the keystore command
+(see {ref}/secure-settings.html[secure settings])
+
+[source,yaml]
+--------------------------------------------------
+bin/elasticsearch-keystore xpack.notification.email.account.exchange_account.smtp.secure_password
+--------------------------------------------------
 
 [float]
 [[email-html-sanitization]]