diff --git a/src/cargo/ops/registry.rs b/src/cargo/ops/registry.rs
index 585592194f2..f8e884f39a7 100644
--- a/src/cargo/ops/registry.rs
+++ b/src/cargo/ops/registry.rs
@@ -834,19 +834,23 @@ pub fn registry_login(
         if generate_keypair {
             assert!(!secret_key_required);
             let kp = AsymmetricKeyPair::<pasetors::version3::V3>::generate().unwrap();
-            let mut key = String::new();
-            FormatAsPaserk::fmt(&kp.secret, &mut key).unwrap();
-            secret_key = Secret::from(key);
+            secret_key = Secret::default().map(|mut key| {
+                FormatAsPaserk::fmt(&kp.secret, &mut key).unwrap();
+                key
+            });
         } else if secret_key_required {
             assert!(!generate_keypair);
             drop_println!(config, "please paste the API secret key below");
-            let mut line = String::new();
-            let input = io::stdin();
-            input
-                .lock()
-                .read_line(&mut line)
-                .with_context(|| "failed to read stdin")?;
-            secret_key = Secret::from(line.trim().to_string());
+            secret_key = Secret::default()
+                .map(|mut line| {
+                    let input = io::stdin();
+                    input
+                        .lock()
+                        .read_line(&mut line)
+                        .with_context(|| "failed to read stdin")
+                        .map(|_| line.trim().to_string())
+                })
+                .transpose()?;
         } else {
             secret_key = old_secret_key
                 .cloned()
diff --git a/src/cargo/util/auth.rs b/src/cargo/util/auth.rs
index 2e7606810d2..1dfa85acb47 100644
--- a/src/cargo/util/auth.rs
+++ b/src/cargo/util/auth.rs
@@ -34,9 +34,9 @@ use super::config::CredentialCacheValue;
 /// ```
 ///
 /// Currently, we write a borrowed `Secret<T>` as `Secret<&T>`.
-/// The [`as_deref`](Secret::as_deref) and [`owned`](Secret::owned) methods can 
+/// The [`as_deref`](Secret::as_deref) and [`owned`](Secret::owned) methods can
 /// be used to convert back and forth between `Secret<String>` and `Secret<&str>`.
-#[derive(Clone, PartialEq, Eq)]
+#[derive(Default, Clone, PartialEq, Eq)]
 pub struct Secret<T> {
     inner: T,
 }