diff --git a/src/auth.rs b/src/auth.rs
index cd79d0d..eeec448 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -1,26 +1,12 @@
-use secrecy::SecretString;
-use serde::Deserialize;
 use std::sync::Arc;
 
 use tokio::sync::Mutex;
 use tracing::instrument;
 
-use crate::db::{Database, SqliteDatabase};
-#[derive(Debug, Clone, Deserialize)]
-pub struct Password(pub SecretString);
-impl From<String> for Password {
-    fn from(value: String) -> Self {
-        Self(SecretString::new(value))
-    }
-}
-
-#[derive(Debug, Clone, Deserialize)]
-pub struct UserToken(pub SecretString);
-impl From<String> for UserToken {
-    fn from(value: String) -> Self {
-        Self(SecretString::new(value))
-    }
-}
+use crate::{
+    db::{Database, SqliteDatabase},
+    secrets::{Password, UserToken},
+};
 
 #[derive(Debug)]
 pub struct Authenticator<DB: Database> {
diff --git a/src/db.rs b/src/db.rs
index 045bcd1..7a1b71e 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -1,7 +1,6 @@
-use secrecy::SecretString;
 use sqlx::{query, query_as, Connection, SqliteConnection};
 
-use crate::auth::UserToken;
+use crate::secrets::UserToken;
 
 // TODO: allow configuring this via envar
 const DB_URI_DEFAULT: &str = "sqlite://sqlite.db";
diff --git a/src/main.rs b/src/main.rs
index ca00b12..88314bf 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -21,6 +21,7 @@
 
 mod auth;
 mod db;
+mod secrets;
 mod server;
 
 use color_eyre::Result;
diff --git a/src/secrets.rs b/src/secrets.rs
new file mode 100644
index 0000000..e2a93fb
--- /dev/null
+++ b/src/secrets.rs
@@ -0,0 +1,18 @@
+use secrecy::SecretString;
+use serde::Deserialize;
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Password(pub SecretString);
+impl From<String> for Password {
+    fn from(value: String) -> Self {
+        Self(SecretString::new(value))
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct UserToken(pub SecretString);
+impl From<String> for UserToken {
+    fn from(value: String) -> Self {
+        Self(SecretString::new(value))
+    }
+}
diff --git a/src/server.rs b/src/server.rs
index 8b3a6f1..bbb9e3c 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -6,7 +6,7 @@ use axum::{
 use serde::{Deserialize, Serialize};
 use tracing::{event, instrument, Level};
 
-use crate::auth::Password;
+use crate::secrets::Password;
 
 #[instrument]
 pub async fn run() -> color_eyre::Result<()> {