diff --git a/backend/internal/api/controller/account.go b/backend/internal/api/controller/account.go
index c2f7e2b..67706dc 100644
--- a/backend/internal/api/controller/account.go
+++ b/backend/internal/api/controller/account.go
@@ -7,6 +7,7 @@ import (
 	"github.com/samber/lo"
 	"github.com/spf13/cast"
 
+	"github.com/veops/oneterm/internal/acl"
 	"github.com/veops/oneterm/internal/model"
 	"github.com/veops/oneterm/internal/service"
 	"github.com/veops/oneterm/pkg/config"
@@ -41,6 +42,20 @@ var (
 		func(ctx *gin.Context, data []*model.Account) {
 			accountService.DecryptSensitiveData(data)
 		},
+		// Filter sensitive fields for non-admin users
+		func(ctx *gin.Context, data []*model.Account) {
+			info := cast.ToBool(ctx.Query("info"))
+			if !info {
+				currentUser, _ := acl.GetSessionFromCtx(ctx)
+				if !acl.IsAdmin(currentUser) {
+					for _, account := range data {
+						account.Password = ""
+						account.Pk = ""
+						account.Phrase = ""
+					}
+				}
+			}
+		},
 	}
 
 	accountDcs = []deleteCheck{