diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog for crypton-x509
 
+## 1.9.2
+
+* Stop printing EC private keys
+  [#34](https://github.com/kazu-yamamoto/crypton-certificate/pull/34)
+
 ## 1.9.1
 
 * Implementing the X509 name constrains extension.
diff --git a/Data/X509/CRL.hs b/Data/X509/CRL.hs
--- a/Data/X509/CRL.hs
+++ b/Data/X509/CRL.hs
@@ -15,8 +15,6 @@
     RevokedCertificate (..),
 ) where
 
-import Control.Applicative
-
 import Data.ASN1.Types
 import Data.Hourglass (DateTime, TimezoneOffset (..))
 
diff --git a/Data/X509/Cert.hs b/Data/X509/Cert.hs
--- a/Data/X509/Cert.hs
+++ b/Data/X509/Cert.hs
@@ -10,7 +10,6 @@
 -- X.509 Certificate types and functions
 module Data.X509.Cert (Certificate (..)) where
 
-import Control.Applicative ((<$>), (<*>))
 import Data.ASN1.Types
 import Data.Hourglass
 import Data.X509.AlgorithmIdentifier
diff --git a/Data/X509/DistinguishedName.hs b/Data/X509/DistinguishedName.hs
--- a/Data/X509/DistinguishedName.hs
+++ b/Data/X509/DistinguishedName.hs
@@ -17,7 +17,6 @@
     getDnElement,
 ) where
 
-import Control.Applicative
 #if MIN_VERSION_base(4,9,0)
 import           Data.Semigroup
 #else
diff --git a/Data/X509/Ext.hs b/Data/X509/Ext.hs
--- a/Data/X509/Ext.hs
+++ b/Data/X509/Ext.hs
@@ -37,7 +37,6 @@
     recognizedOIDs,
 ) where
 
-import Control.Applicative
 import Control.Monad
 import Data.ASN1.BinaryEncoding
 import Data.ASN1.BitArray
diff --git a/Data/X509/ExtensionRaw.hs b/Data/X509/ExtensionRaw.hs
--- a/Data/X509/ExtensionRaw.hs
+++ b/Data/X509/ExtensionRaw.hs
@@ -13,7 +13,6 @@
     Extensions (..),
 ) where
 
-import Control.Applicative
 import Data.ASN1.BinaryEncoding
 import Data.ASN1.Encoding
 import Data.ASN1.Types
diff --git a/Data/X509/OID.hs b/Data/X509/OID.hs
--- a/Data/X509/OID.hs
+++ b/Data/X509/OID.hs
@@ -11,7 +11,6 @@
     curvesOIDTable,
 ) where
 
-import Control.Applicative
 import Crypto.PubKey.ECC.Types
 import Data.ASN1.OID
 import Data.List (find)
diff --git a/Data/X509/PrivateKey.hs b/Data/X509/PrivateKey.hs
--- a/Data/X509/PrivateKey.hs
+++ b/Data/X509/PrivateKey.hs
@@ -12,9 +12,7 @@
     privkeyToAlg,
 ) where
 
-import Control.Applicative (pure, (<$>))
 import Data.Maybe (fromMaybe)
-import Data.Word (Word)
 
 import Data.ByteArray (ByteArrayAccess, convert)
 import qualified Data.ByteString as B
@@ -29,6 +27,7 @@
 import Data.X509.OID (curvesOIDTable, lookupByOID, lookupOID)
 import Data.X509.PublicKey (SerializedPoint (..))
 
+import Crypto.Debug (DebugShow (..))
 import Crypto.Error (CryptoFailable (..))
 import Crypto.Number.Serialize (i2osp, os2ip)
 import qualified Crypto.PubKey.Curve25519 as X25519
@@ -57,8 +56,48 @@
         { privkeyEC_name :: ECC.CurveName
         , privkeyEC_priv :: Integer
         }
-    deriving (Show, Eq)
+    deriving (Eq)
 
+-- | The curve is shown; @privkeyEC_priv@ is not.  Use
+-- 'Crypto.Debug.debugShow' to see it.
+instance Show PrivKeyEC where
+    showsPrec = showsPrivKeyEC (showString "<secret>")
+
+instance DebugShow PrivKeyEC where
+    debugShow k = showsPrivKeyEC (shows $ privkeyEC_priv k) 0 k ""
+
+-- | What the two instances above share, so that a field added to
+-- 'PrivKeyEC' cannot reach one of them and not the other.  The first
+-- argument renders @privkeyEC_priv@; everything else is what @deriving
+-- Show@ used to write.
+showsPrivKeyEC :: ShowS -> Int -> PrivKeyEC -> ShowS
+showsPrivKeyEC priv d (PrivKeyEC_Prime _ a b p g o c s) =
+    showParen (d > 10) $
+        showString "PrivKeyEC_Prime {privkeyEC_priv = "
+            . priv
+            . showString ", privkeyEC_a = "
+            . shows a
+            . showString ", privkeyEC_b = "
+            . shows b
+            . showString ", privkeyEC_prime = "
+            . shows p
+            . showString ", privkeyEC_generator = "
+            . shows g
+            . showString ", privkeyEC_order = "
+            . shows o
+            . showString ", privkeyEC_cofactor = "
+            . shows c
+            . showString ", privkeyEC_seed = "
+            . shows s
+            . showChar '}'
+showsPrivKeyEC priv d (PrivKeyEC_Named n _) =
+    showParen (d > 10) $
+        showString "PrivKeyEC_Named {privkeyEC_name = "
+            . shows n
+            . showString ", privkeyEC_priv = "
+            . priv
+            . showChar '}'
+
 -- | Private key types known and used in X.509
 data PrivKey
     = -- | RSA private key
@@ -76,6 +115,21 @@
     | -- | Ed448 private key
       PrivKeyEd448 Ed448.SecretKey
     deriving (Show, Eq)
+
+-- | Rendering a private key with the key material in it, for the times when
+-- that is what is meant.  Each arm is @crypton@'s own 'debugShow' for that
+-- key type, except the EC one, which is this module's.
+instance DebugShow PrivKey where
+    debugShow k = case k of
+        PrivKeyRSA p -> con "PrivKeyRSA" $ debugShow p
+        PrivKeyDSA p -> con "PrivKeyDSA" $ debugShow p
+        PrivKeyEC p -> con "PrivKeyEC" $ debugShow p
+        PrivKeyX25519 p -> con "PrivKeyX25519" $ debugShow p
+        PrivKeyX448 p -> con "PrivKeyX448" $ debugShow p
+        PrivKeyEd25519 p -> con "PrivKeyEd25519" $ debugShow p
+        PrivKeyEd448 p -> con "PrivKeyEd448" $ debugShow p
+      where
+        con name body = name ++ " (" ++ body ++ ")"
 
 instance ASN1Object PrivKey where
     fromASN1 = privkeyFromASN1
diff --git a/Tests/Tests.hs b/Tests/Tests.hs
--- a/Tests/Tests.hs
+++ b/Tests/Tests.hs
@@ -7,18 +7,19 @@
 
 import qualified Data.ByteString as B
 
-import Control.Applicative
 import Control.Monad
 
+import Crypto.Debug (DebugShow (..))
 import Crypto.Error (throwCryptoError)
 import qualified Crypto.PubKey.Curve25519 as X25519
 import qualified Crypto.PubKey.Curve448 as X448
 import qualified Crypto.PubKey.DSA as DSA
+import qualified Crypto.PubKey.ECC.Types as ECC
 import qualified Crypto.PubKey.Ed25519 as Ed25519
 import qualified Crypto.PubKey.Ed448 as Ed448
 import qualified Crypto.PubKey.RSA as RSA
 import Data.ASN1.Types
-import Data.List (nub, sort)
+import Data.List (isInfixOf, nub, sort)
 import Data.X509
 
 import Data.Hourglass
@@ -244,6 +245,30 @@
     got = fromASN1 oMarshalled
     oMarshalled = toASN1 o []
 
+-- | A scalar long enough that finding it in the rendered key cannot be an
+-- accident of the curve parameters beside it.
+newtype ECSecret = ECSecret Integer
+    deriving (Show)
+
+instance Arbitrary ECSecret where
+    arbitrary = ECSecret <$> choose (10 ^ (40 :: Int), 10 ^ (41 :: Int))
+
+-- | 'show' of an EC private key holds the curve and not the scalar, and
+-- 'debugShow' holds both.  The wrapper is checked too, since it is
+-- @Credential@ and @ServerParams@ that a program actually prints.
+property_ec_show_redacts :: ECSecret -> Bool
+property_ec_show_redacts (ECSecret d) = all ok [named, prime]
+  where
+    named = PrivKeyEC_Named ECC.SEC_p256r1 d
+    prime = PrivKeyEC_Prime d 1 2 3 (SerializedPoint B.empty) 4 1 5
+    digits = show d
+    ok k =
+        not (digits `isInfixOf` show k)
+            && not (digits `isInfixOf` show (PrivKeyEC k))
+            && "<secret>" `isInfixOf` show k
+            && digits `isInfixOf` debugShow k
+            && digits `isInfixOf` debugShow (PrivKeyEC k)
+
 property_extension_id :: (Show e, Eq e, Extension e) => e -> Bool
 property_extension_id e = case extDecode (extEncode e) of
     Left err -> error err
@@ -277,4 +302,7 @@
                     (property_unmarshall_marshall_id :: Certificate -> Bool)
                 , testProperty "crl" (property_unmarshall_marshall_id :: CRL -> Bool)
                 ]
+            , testGroup
+                "show"
+                [testProperty "ec privkey is redacted" property_ec_show_redacts]
             ]
diff --git a/crypton-x509.cabal b/crypton-x509.cabal
--- a/crypton-x509.cabal
+++ b/crypton-x509.cabal
@@ -1,6 +1,6 @@
 cabal-version:      >=1.10
 name:               crypton-x509
-version:            1.9.1
+version:            1.9.2
 license:            BSD3
 license-file:       LICENSE
 copyright:          Vincent Hanquez <vincent@snarc.org>
@@ -44,7 +44,7 @@
         base >=4.7 && <5,
         bytestring,
         containers,
-        crypton >=1.1 && <1.2,
+        crypton >=2.0 && <2.2,
         crypton-asn1-encoding >=0.10.0 && <0.11,
         crypton-asn1-parse >=0.10.0 && <0.11,
         crypton-asn1-types >=0.4.1 && <0.5,