diff --git a/awx/api/views.py b/awx/api/views.py
index c897b83e9e..e5b9b2ea6c 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -2421,7 +2421,13 @@ class JobTemplateSurveySpec(GenericAPIView):
         if not feature_enabled('surveys'):
             raise LicenseForbids(_('Your license does not allow '
                                    'adding surveys.'))
-        return Response(obj.survey_spec)
+        survey_spec = obj.survey_spec
+        for pos, field in enumerate(survey_spec.get('spec', [])):
+            if field.get('type') == 'password':
+                if 'default' in field and field['default']:
+                    field['default'] = '$encrypted$'
+
+        return Response(survey_spec)
 
     def post(self, request, *args, **kwargs):
         obj = self.get_object()
@@ -2445,6 +2451,7 @@ class JobTemplateSurveySpec(GenericAPIView):
             return Response(dict(error=_("'spec' must be a list of items.")), status=status.HTTP_400_BAD_REQUEST)
         if len(new_spec["spec"]) < 1:
             return Response(dict(error=_("'spec' doesn't contain any items.")), status=status.HTTP_400_BAD_REQUEST)
+
         idx = 0
         variable_set = set()
         for survey_item in new_spec["spec"]:
@@ -2463,7 +2470,15 @@ class JobTemplateSurveySpec(GenericAPIView):
                 variable_set.add(survey_item['variable'])
             if "required" not in survey_item:
                 return Response(dict(error=_("'required' missing from survey question %s.") % str(idx)), status=status.HTTP_400_BAD_REQUEST)
+
+            if survey_item["type"] == "password":
+                if "default" in survey_item and survey_item["default"].startswith('$encrypted$'):
+                    old_spec = obj.survey_spec
+                    for old_item in old_spec['spec']:
+                        if old_item['variable'] == survey_item['variable']:
+                            survey_item['default'] = old_item['default']
             idx += 1
+
         obj.survey_spec = new_spec
         obj.save(update_fields=['survey_spec'])
         return Response()
diff --git a/awx/main/models/mixins.py b/awx/main/models/mixins.py
index d70756251f..5b1b02b113 100644
--- a/awx/main/models/mixins.py
+++ b/awx/main/models/mixins.py
@@ -113,12 +113,6 @@ class SurveyJobTemplateMixin(models.Model):
         # Job Template extra_vars
         extra_vars = self.extra_vars_dict
 
-        # Overwrite with job template extra vars with survey default vars
-        if self.survey_enabled and 'spec' in self.survey_spec:
-            for survey_element in self.survey_spec.get("spec", []):
-                if 'default' in survey_element and survey_element['default']:
-                    extra_vars[survey_element['variable']] = survey_element['default']
-
         # transform to dict
         if 'extra_vars' in kwargs:
             kwargs_extra_vars = kwargs['extra_vars']
@@ -126,6 +120,18 @@ class SurveyJobTemplateMixin(models.Model):
         else:
             kwargs_extra_vars = {}
 
+        # Overwrite with job template extra vars with survey default vars
+        if self.survey_enabled and 'spec' in self.survey_spec:
+            for survey_element in self.survey_spec.get("spec", []):
+                default = survey_element['default']
+                variable_key = survey_element['variable']
+                if survey_element.get('type') == 'password':
+                    if variable_key in kwargs_extra_vars:
+                        kw_value = kwargs_extra_vars[variable_key]
+                        if kw_value.startswith('$encrypted$') and kw_value != default:
+                            kwargs_extra_vars[variable_key] = default
+                extra_vars[variable_key] = default
+
         # Overwrite job template extra vars with explicit job extra vars
         # and add on job extra vars
         extra_vars.update(kwargs_extra_vars)