diff --git a/CHANGES.rst b/CHANGES.rst
index b8966d1..a2cd283 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -3,6 +3,7 @@ Change log
 
 5.1 (unreleased)
 ----------------
+- Ensure key 'passw' is treated as string for the 'in' check in ``__repr__``
 
 
 5.0 (2025-11-19)
diff --git a/src/Products/mcdutils/mapping.py b/src/Products/mcdutils/mapping.py
index ca82248..07931ea 100644
--- a/src/Products/mcdutils/mapping.py
+++ b/src/Products/mcdutils/mapping.py
@@ -65,8 +65,20 @@ def __repr__(self):
         # Overriding here to try and hide some password fields, like
         # the ZPublisher HTTPRequest class tries to do.
         new_dict = dict(self.data)
-        for key in new_dict.keys():
-            if 'passw' in key.lower():
+        for key in list(new_dict.keys()):
+            k_str = (
+                key.decode("utf-8", "replace")
+                if isinstance(key, (bytes, bytearray))
+                else str(key)
+            )
+            lower_key = k_str.lower()
+            if any(
+                marker in lower_key for marker in (
+                    'passw',
+                    'pwd',
+                    'secret',
+                    'token',
+                    'cred')):
                 new_dict[key] = '<password obscured>'
         return repr(new_dict)