diff --git a/cmd/kubeadm/app/cmd/init.go b/cmd/kubeadm/app/cmd/init.go
index 0d962d40bd8..358320ff280 100644
--- a/cmd/kubeadm/app/cmd/init.go
+++ b/cmd/kubeadm/app/cmd/init.go
@@ -72,6 +72,7 @@ func NewCmdInit(out io.Writer) *cobra.Command {
 
 	var cfgPath string
 	var skipPreFlight bool
+	var skipTokenPrint bool
 	cmd := &cobra.Command{
 		Use:   "init",
 		Short: "Run this in order to set up the Kubernetes master",
@@ -80,7 +81,7 @@ func NewCmdInit(out io.Writer) *cobra.Command {
 			internalcfg := &kubeadmapi.MasterConfiguration{}
 			api.Scheme.Convert(cfg, internalcfg, nil)
 
-			i, err := NewInit(cfgPath, internalcfg, skipPreFlight)
+			i, err := NewInit(cfgPath, internalcfg, skipPreFlight, skipTokenPrint)
 			kubeadmutil.CheckErr(err)
 			kubeadmutil.CheckErr(i.Validate())
 			kubeadmutil.CheckErr(i.Run(out))
@@ -126,6 +127,10 @@ func NewCmdInit(out io.Writer) *cobra.Command {
 		&skipPreFlight, "skip-preflight-checks", skipPreFlight,
 		"Skip preflight checks normally run before modifying the system",
 	)
+	cmd.PersistentFlags().BoolVar(
+		&skipTokenPrint, "skip-token-print", skipTokenPrint,
+		"Skip printing of the default bootstrap token generated by 'kubeadm init'",
+	)
 
 	cmd.PersistentFlags().StringVar(
 		&cfg.Token, "token", cfg.Token,
@@ -138,7 +143,7 @@ func NewCmdInit(out io.Writer) *cobra.Command {
 	return cmd
 }
 
-func NewInit(cfgPath string, cfg *kubeadmapi.MasterConfiguration, skipPreFlight bool) (*Init, error) {
+func NewInit(cfgPath string, cfg *kubeadmapi.MasterConfiguration, skipPreFlight, skipTokenPrint bool) (*Init, error) {
 
 	fmt.Println("[kubeadm] WARNING: kubeadm is in beta, please do not use it for production clusters.")
 
@@ -177,11 +182,12 @@ func NewInit(cfgPath string, cfg *kubeadmapi.MasterConfiguration, skipPreFlight
 	// Try to start the kubelet service in case it's inactive
 	preflight.TryStartKubelet()
 
-	return &Init{cfg: cfg}, nil
+	return &Init{cfg: cfg, skipTokenPrint: skipTokenPrint}, nil
 }
 
 type Init struct {
-	cfg *kubeadmapi.MasterConfiguration
+	cfg            *kubeadmapi.MasterConfiguration
+	skipTokenPrint bool
 }
 
 // Validate validates configuration passed to "kubeadm init"
@@ -232,7 +238,9 @@ func (i *Init) Run(out io.Writer) error {
 	}
 
 	// PHASE 4: Set up the bootstrap tokens
-	fmt.Printf("[token] Using token: %s\n", i.cfg.Token)
+	if !i.skipTokenPrint {
+		fmt.Printf("[token] Using token: %s\n", i.cfg.Token)
+	}
 
 	tokenDescription := "The default bootstrap token generated by 'kubeadm init'."
 	if err := tokenphase.UpdateOrCreateToken(client, i.cfg.Token, false, i.cfg.TokenTTL, kubeadmconstants.DefaultTokenUsages, tokenDescription); err != nil {
@@ -267,6 +275,9 @@ func (i *Init) Run(out io.Writer) error {
 		"MasterIP":       i.cfg.API.AdvertiseAddress,
 		"MasterPort":     strconv.Itoa(int(i.cfg.API.BindPort)),
 	}
+	if i.skipTokenPrint {
+		ctx["Token"] = "<value withheld>"
+	}
 
 	return initDoneTempl.Execute(out, ctx)
 }
diff --git a/hack/verify-flags/known-flags.txt b/hack/verify-flags/known-flags.txt
index 8e4f2ea913f..76f40b59b44 100644
--- a/hack/verify-flags/known-flags.txt
+++ b/hack/verify-flags/known-flags.txt
@@ -648,6 +648,7 @@ since-time
 skip-generated-rewrite
 skip-munges
 skip-preflight-checks
+skip-token-print
 skip-unsafe
 sort-by
 source-file