diff --git a/php/src/Desec/DesecManager.php b/php/src/Desec/DesecManager.php
index f6bb7531..080e726b 100644
--- a/php/src/Desec/DesecManager.php
+++ b/php/src/Desec/DesecManager.php
@@ -99,12 +99,20 @@ class DesecManager {
         if ($this->configurationManager->isDesecAwaitingVerification()) {
             $storedEmail    = $this->configurationManager->desecEmail;
             // Prefer a freshly entered password (e.g. the user changed it), else the generated one.
-            $loginPassword  = $validatedPassword !== '' ? $validatedPassword : $this->configurationManager->desecPassword;
+            $userSuppliedPassword = $validatedPassword !== '';
+            $loginPassword  = $userSuppliedPassword ? $validatedPassword : $this->configurationManager->desecPassword;
             $token          = $this->loginAfterVerification($storedEmail, $loginPassword);
             // Storing the token flips the state from "awaiting verification" to "account
             // registered" (see ConfigurationManager::isDesecAwaitingVerification()).
             $this->configurationManager->desecToken = $token;
-            return [$token, true];
+            // If the user logged in with their own password (the email already had a deSEC
+            // account, so no AIO account was created), the previously generated password is
+            // wrong and must not be persisted or later revealed. Clear it so a stored,
+            // non-empty password reliably means "AIO generated this account".
+            if ($userSuppliedPassword) {
+                $this->configurationManager->desecPassword = '';
+            }
+            return [$token, !$userSuppliedPassword];
         }
 
         $validatedEmail = $this->validateEmail($email);
diff --git a/php/templates/containers.twig b/php/templates/containers.twig
index 7f27ccf6..6284ff14 100644
--- a/php/templates/containers.twig
+++ b/php/templates/containers.twig
@@ -404,10 +404,18 @@
 
                         {% if is_desec_domain %}
                             <h2>deSEC account credentials</h2>
-                            <p>Your domain <strong>{{ domain }}</strong> is managed via <a target="_blank" href="https://desec.io">deSEC</a>. Below are your deSEC account credentials. You can use them to log in at <a target="_blank" href="https://desec.io">desec.io</a> to manage your domain directly.</p>
-                            <p>Email: <strong>{{ desec_email }}</strong></p>
-                            <p><details class="inline-details"><summary>Reveal deSEC password</summary><strong>{{ desec_password }}</strong></details></p>
-                            <p>Please save these credentials in a safe place.</p>
+                            {% if desec_password %}
+                                {# AIO created this account, so it generated and stored the password.
+                                   Show it so the user can log in at desec.io if they ever need to. #}
+                                <p>Your domain <strong>{{ domain }}</strong> is managed via <a target="_blank" href="https://desec.io">deSEC</a>. Below are your deSEC account credentials. You can use them to log in at <a target="_blank" href="https://desec.io">desec.io</a> to manage your domain directly.</p>
+                                <p>Email: <strong>{{ desec_email }}</strong></p>
+                                <p><details class="inline-details"><summary>Reveal deSEC password</summary><strong>{{ desec_password }}</strong></details></p>
+                                <p>Please save these credentials in a safe place.</p>
+                            {% else %}
+                                {# The user logged in with their own existing deSEC account; AIO never
+                                   stored their password, so there is nothing to reveal. #}
+                                <p>Your domain <strong>{{ domain }}</strong> is managed via your existing <a target="_blank" href="https://desec.io">deSEC</a> account (<strong>{{ desec_email }}</strong>). Log in at <a target="_blank" href="https://desec.io">desec.io</a> with your own password to manage your domain directly.</p>
+                            {% endif %}
                         {% endif %}
 
                         {% if is_backup_section_enabled == false %}