diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7cdf9352822c..03af2e0a1ecc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1406,6 +1406,8 @@ in
   sympa = runTest ./sympa.nix;
   syncthing = runTest ./syncthing/main.nix;
   syncthing-folders = runTest ./syncthing/folders.nix;
+  syncthing-guiPassword = runTest ./syncthing/guiPassword.nix;
+  syncthing-guiPasswordFile = runTest ./syncthing/guiPasswordFile.nix;
   syncthing-init = runTest ./syncthing/init.nix;
   syncthing-many-devices = runTest ./syncthing/many-devices.nix;
   syncthing-no-settings = runTest ./syncthing/no-settings.nix;
diff --git a/nixos/tests/syncthing/guiPassword.nix b/nixos/tests/syncthing/guiPassword.nix
new file mode 100644
index 000000000000..ab802b68f6c0
--- /dev/null
+++ b/nixos/tests/syncthing/guiPassword.nix
@@ -0,0 +1,56 @@
+{ lib, pkgs, ... }:
+{
+  name = "syncthing-guiPassword";
+  meta.maintainers = with lib.maintainers; [ nullcube ];
+  enableOCR = true;
+
+  nodes.machine = {
+    imports = [ ../common/x11.nix ];
+    environment.systemPackages = with pkgs; [
+      syncthing
+      xdotool
+    ];
+
+    programs.firefox = {
+      enable = true;
+      preferences = {
+        # Prevent firefox from asking to save the password
+        "signon.rememberSignons" = false;
+      };
+    };
+
+    services.syncthing = {
+      enable = true;
+      settings.options.urAccepted = -1;
+      settings.gui = {
+        insecureAdminAccess = false;
+        user = "alice";
+        password = "alice_password";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_x()
+    machine.execute("xterm -e 'firefox 127.0.0.1:8384' >&2 &")
+    machine.wait_for_window("Syncthing")
+    machine.screenshot("pre-login")
+
+    with subtest("Syncthing requests authentication"):
+      machine.wait_for_text("Authentication Required", 10)
+
+    with subtest("Syncthing password is valid"):
+      machine.execute("xdotool type \"alice\"")
+      machine.execute("xdotool key Tab")
+      machine.execute("xdotool type \"alice_password\"")
+      machine.execute("xdotool key Enter")
+      machine.sleep(2)
+      machine.wait_for_text("This Device", 10)
+      machine.screenshot("post-login")
+
+    with subtest("Plaintext Syncthing password is not in final config"):
+      config = machine.succeed("cat /var/lib/syncthing/.config/syncthing/config.xml")
+      assert "alice_password" not in config
+  '';
+}
diff --git a/nixos/tests/syncthing/guiPasswordFile.nix b/nixos/tests/syncthing/guiPasswordFile.nix
new file mode 100644
index 000000000000..fa25fe946c6a
--- /dev/null
+++ b/nixos/tests/syncthing/guiPasswordFile.nix
@@ -0,0 +1,56 @@
+{ lib, pkgs, ... }:
+{
+  name = "syncthing-guiPasswordFile";
+  meta.maintainers = with lib.maintainers; [ nullcube ];
+  enableOCR = true;
+
+  nodes.machine = {
+    imports = [ ../common/x11.nix ];
+    environment.systemPackages = with pkgs; [
+      syncthing
+      xdotool
+    ];
+
+    programs.firefox = {
+      enable = true;
+      preferences = {
+        # Prevent firefox from asking to save the password
+        "signon.rememberSignons" = false;
+      };
+    };
+
+    services.syncthing = {
+      enable = true;
+      settings.options.urAccepted = -1;
+      settings.gui = {
+        insecureAdminAccess = false;
+        user = "alice";
+      };
+      guiPasswordFile = (pkgs.writeText "syncthing-password-file" ''alice_password'').outPath;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("syncthing.service")
+    machine.wait_for_x()
+    machine.execute("xterm -e 'firefox 127.0.0.1:8384' >&2 &")
+    machine.wait_for_window("Syncthing")
+    machine.screenshot("pre-login")
+
+    with subtest("Syncthing requests authentication"):
+      machine.wait_for_text("Authentication Required", 10)
+
+    with subtest("Syncthing password is valid"):
+      machine.execute("xdotool type \"alice\"")
+      machine.execute("xdotool key Tab")
+      machine.execute("xdotool type \"alice_password\"")
+      machine.execute("xdotool key Enter")
+      machine.sleep(2)
+      machine.wait_for_text("This Device", 10)
+      machine.screenshot("post-login")
+
+    with subtest("Plaintext Syncthing password is not in final config"):
+      config = machine.succeed("cat /var/lib/syncthing/.config/syncthing/config.xml")
+      assert "alice_password" not in config
+  '';
+}
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 50506a77f795..e1a5709cd23a 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -67,6 +67,8 @@ let
         tests = {
           inherit (nixosTests)
             syncthing
+            syncthing-guiPassword
+            syncthing-guiPasswordFile
             syncthing-init
             syncthing-many-devices
             syncthing-no-settings