diff --git a/awx/main/models/mixins.py b/awx/main/models/mixins.py
index 80eabf3495..952377c112 100644
--- a/awx/main/models/mixins.py
+++ b/awx/main/models/mixins.py
@@ -127,10 +127,10 @@ class SurveyJobTemplateMixin(models.Model):
         # Overwrite with job template extra vars with survey default vars
         if self.survey_enabled and 'spec' in self.survey_spec:
             for survey_element in self.survey_spec.get("spec", []):
-                default = survey_element['default']
-                variable_key = survey_element['variable']
+                default = survey_element.get('default')
+                variable_key = survey_element.get('variable')
                 if survey_element.get('type') == 'password':
-                    if variable_key in kwargs_extra_vars:
+                    if variable_key in kwargs_extra_vars and default:
                         kw_value = kwargs_extra_vars[variable_key]
                         if kw_value.startswith('$encrypted$') and kw_value != default:
                             kwargs_extra_vars[variable_key] = default
diff --git a/awx/main/tests/unit/api/test_views.py b/awx/main/tests/unit/api/test_views.py
index 37b9177db7..3bea19cedd 100644
--- a/awx/main/tests/unit/api/test_views.py
+++ b/awx/main/tests/unit/api/test_views.py
@@ -1,9 +1,12 @@
 import mock
 import pytest
 
+from collections import namedtuple
+
 from awx.api.views import (
     ApiV1RootView,
     JobTemplateLabelList,
+    JobTemplateSurveySpec,
 )
 
 
@@ -65,3 +68,16 @@ class TestJobTemplateLabelList:
 
             super(JobTemplateLabelList, view).unattach(mock_request, None, None)
             assert mixin_unattach.called_with(mock_request, None, None)
+
+
+class TestJobTemplateSurveySpec(object):
+    @mock.patch('awx.api.views.feature_enabled', lambda feature: True)
+    def test_get_password_type(self, mocker, mock_response_new):
+        JobTemplate = namedtuple('JobTemplate', 'survey_spec')
+        obj = JobTemplate(survey_spec={'spec':[{'type': 'password', 'default': 'my_default'}]})
+        with mocker.patch.object(JobTemplateSurveySpec, 'get_object', return_value=obj):
+            view = JobTemplateSurveySpec()
+            response = view.get(mocker.MagicMock())
+            assert response == mock_response_new
+            # which there was a better way to do this!
+            assert response.call_args[0][1]['spec'][0]['default'] == '$encrypted$'
diff --git a/awx/main/tests/unit/models/test_job_template_unit.py b/awx/main/tests/unit/models/test_job_template_unit.py
index 28f2dc2993..dade874617 100644
--- a/awx/main/tests/unit/models/test_job_template_unit.py
+++ b/awx/main/tests/unit/models/test_job_template_unit.py
@@ -84,3 +84,18 @@ def test_job_template_survey_variable_validation(job_template_factory):
     }
     obj.survey_enabled = True
     assert obj.survey_variable_validation({"a": 5}) == ["Value 5 for 'a' expected to be a string."]
+
+
+def test_job_template_survey_mixin(job_template_factory):
+    objects = job_template_factory(
+        'survey_mixin_test',
+        organization='org1',
+        inventory='inventory1',
+        credential='cred1',
+        persisted=False,
+    )
+    obj = objects.job_template
+    obj.survey_enabled = True
+    obj.survey_spec = {'spec': [{'default':'my_default', 'type':'password', 'variable':'my_variable'}]}
+    kwargs = obj._update_unified_job_kwargs(extra_vars={'my_variable':'$encrypted$'})
+    assert kwargs['extra_vars'] == '{"my_variable": "my_default"}'