diff --git a/connections/connection-form.mdx b/connections/connection-form.mdx
index b6d8601..686c1c4 100644
--- a/connections/connection-form.mdx
+++ b/connections/connection-form.mdx
@@ -31,7 +31,7 @@ The bar along the bottom carries **Test Connection**, **Cancel** and **Save**, p
 | **Socket** | Replaces Host when **Connect Using** is **Socket**. MySQL and MariaDB take the socket file, such as `/tmp/mysql.sock`, and drop Port. PostgreSQL takes the folder, such as `/tmp`, and keeps Port, which names the file |
 | **Database** | Optional on drivers that browse every database from one session. PostgreSQL and Redshift do not connect without one |
 | **Username** | Not pre-filled. Empty means the driver's own default |
-| **Password** | Stored in the macOS Keychain |
+| **Password** | Stored in the macOS Keychain. **Show password** reveals a saved one after Touch ID or your Mac's password. A connection whose password comes from a [password source](/features/connection-sharing#password-sources) shows the source here, with **Test Source** |
 | **Prompt for password** | Stores nothing, asks on every connect. Reads **Prompt for API token** on API-only drivers |
 | **Use Password File** | PostgreSQL, Redshift, and CockroachDB. Reads `~/.pgpass`, and reports underneath whether the file exists, has `chmod 0600`, and holds a matching line |
 
diff --git a/connections/credential-profiles.mdx b/connections/credential-profiles.mdx
index a8faa28..83f0481 100644
--- a/connections/credential-profiles.mdx
+++ b/connections/credential-profiles.mdx
@@ -49,6 +49,8 @@ A linked connection keeps no password of its own. Linking deletes the one it had
 
 Pick **Saved in the Keychain** unless something else already owns the password. **Read from elsewhere** never leaves this Mac and never syncs.
 
+**Test Source** runs a **Read from elsewhere** source without connecting. It shows the password hidden, or the error with what the command printed to stderr. **Show password** reveals it after Touch ID or your Mac's password, and does the same for a password saved in the Keychain. A connection using the profile has its own **Test Source**, which fills in that connection's host, port, user and database.
+
 ## Vault database roles
 
 A role on Vault's database secrets engine hands out a new database user for every lease. Set **Source** to **Read from elsewhere** and **Read From** to **HashiCorp Vault database role**, then fill in:
diff --git a/features/connection-sharing.mdx b/features/connection-sharing.mdx
index 750fdf0..956da8d 100644
--- a/features/connection-sharing.mdx
+++ b/features/connection-sharing.mdx
@@ -154,7 +154,7 @@ Write `$VAR` or `${VAR}` in a `.tablepro` file and it resolves from TablePro's p
 
 ## Password sources
 
-A connection in `~/Library/Application Support/TablePro/connections.json` can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection.
+A connection in `~/Library/Application Support/TablePro/connections.json` can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection. Open the connection to see its source under **Password**, and click **Test Source** to run it without connecting.
 
 ```json
 { "passwordSource": { "kind": "file", "path": "~/.config/tablepro/secrets/feature-x.pw" } }