diff --git a/test/e2e/app_management_test.go b/test/e2e/app_management_test.go
index c1eeb2a21f..80edbdfd57 100644
--- a/test/e2e/app_management_test.go
+++ b/test/e2e/app_management_test.go
@@ -284,7 +284,7 @@ func TestAppWithSecrets(t *testing.T) {
 
 			diffOutput, err := fixture.RunCli("app", "diff", app.Name)
 			assert.Error(t, err)
-			assert.Contains(t, diffOutput, "username: '*********'")
+			assert.Contains(t, diffOutput, "username: +++++++++")
 
 			// local diff should ignore secrets
 			diffOutput, err = fixture.RunCli("app", "diff", app.Name, "--local", "testdata/secrets")
diff --git a/util/diff/diff.go b/util/diff/diff.go
index 64a2ce4a3b..9cef1e1adb 100644
--- a/util/diff/diff.go
+++ b/util/diff/diff.go
@@ -387,7 +387,8 @@ func HideSecretData(target *unstructured.Unstructured, live *unstructured.Unstru
 	}
 
 	for k := range keys {
-		nextReplacement := "*********"
+		// we use "+" rather than the more common "*"
+		nextReplacement := "+++++++++"
 		valToReplacement := make(map[string]string)
 		for _, obj := range []*unstructured.Unstructured{target, live, orig} {
 			var data map[string]interface{}
@@ -409,7 +410,7 @@ func HideSecretData(target *unstructured.Unstructured, live *unstructured.Unstru
 			replacement, ok := valToReplacement[val]
 			if !ok {
 				replacement = nextReplacement
-				nextReplacement = nextReplacement + "*"
+				nextReplacement = nextReplacement + "+"
 				valToReplacement[val] = replacement
 			}
 			data[k] = replacement
diff --git a/util/diff/diff_test.go b/util/diff/diff_test.go
index 2935f64db9..b802e226c5 100644
--- a/util/diff/diff_test.go
+++ b/util/diff/diff_test.go
@@ -534,9 +534,9 @@ func secretData(obj *unstructured.Unstructured) map[string]interface{} {
 }
 
 const (
-	replacement1 = "*********"
-	replacement2 = "**********"
-	replacement3 = "***********"
+	replacement1 = "+++++++++"
+	replacement2 = "++++++++++"
+	replacement3 = "+++++++++++"
 )
 
 func TestHideSecretDataSameKeysDifferentValues(t *testing.T) {