Amen. and if it can be taken a step further, never displayed the encrypted form either. 'cause some systems can suffer from playback vulnerabilities. Like encrypted cookies. Don't need to know the contents.. just need to have the key.