diff --git a/lib/ansible/modules/extras/network/asa/asa_config.py b/lib/ansible/modules/extras/network/asa/asa_config.py
index 320255b46f0..4cd8b58635c 100644
--- a/lib/ansible/modules/extras/network/asa/asa_config.py
+++ b/lib/ansible/modules/extras/network/asa/asa_config.py
@@ -146,14 +146,14 @@ options:
     required: false
     default: no
     choices: ['yes', 'no']
-  passwords:
+  mask_passwords:
     description:
       - This argument specifies to include passwords in the config
         when retrieving the running-config from the remote device.  This
         includes passwords related to VPN endpoints.  This argument is
         mutually exclusive with I(defaults).
-    required: false
-    default: no
+    required: true
+    default: true
     choices: ['yes', 'no']
   save:
     description:
@@ -235,9 +235,9 @@ from ansible.module_utils.netcfg import NetworkConfig, dumps
 def get_config(module):
     contents = module.params['config']
     if not contents:
-        if module.params['defaults']:
+        if module.params['defaults'] is True:
             include = 'defaults'
-        elif module.params['passwords']:
+        elif module.params['mask_passwords'] is False:
             include = 'passwords'
         else:
             include = None
@@ -307,13 +307,13 @@ def main():
 
         config=dict(),
         defaults=dict(type='bool', default=False),
-        passwords=dict(type='bool', default=False),
+        mask_passwords=dict(type='bool', default=True),
 
         backup=dict(type='bool', default=False),
         save=dict(type='bool', default=False),
     )
 
-    mutually_exclusive = [('lines', 'src'), ('defaults', 'passwords')]
+    mutually_exclusive = [('lines', 'src'), ('defaults', 'mask_passwords')]
 
     required_if = [('match', 'strict', ['lines']),
                    ('match', 'exact', ['lines']),