diff --git a/app/Models/User.php b/app/Models/User.php
index d6389d678..e2ecae56a 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -26,6 +26,8 @@ class User extends Authenticatable implements SendsEmail
     protected $hidden = [
         'password',
         'remember_token',
+        'two_factor_recovery_codes',
+        'two_factor_secret',
     ];
     protected $casts = [
         'email_verified_at' => 'datetime',