diff --git a/cmd/root.go b/cmd/root.go
index 2a87c1d..5e5c4e0 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -64,6 +64,9 @@ func PreRun(cmd *cobra.Command, args []string) {
 	if enabled, _ := f.GetBool("debug"); enabled {
 		log.SetLevel(log.DebugLevel)
 	}
+	if enabled, _ := f.GetBool("trace"); enabled {
+		log.SetLevel(log.TraceLevel)
+	}
 
 	pollingSet := f.Changed("interval")
 	schedule, _ := f.GetString("schedule")
diff --git a/docs/arguments.md b/docs/arguments.md
index 7d5d7c4..b22aa79 100644
--- a/docs/arguments.md
+++ b/docs/arguments.md
@@ -72,12 +72,22 @@ Environment Variable: WATCHTOWER_REMOVE_VOLUMES
 Enable debug mode with verbose logging.
 
 ```
-            Argument: --debug
+            Argument: --debug, -d
 Environment Variable: WATCHTOWER_DEBUG
                 Type: Boolean
              Default: false
 ```
 
+## Trace
+Enable trace mode with very verbose logging. Caution: exposes credentials!
+
+```
+            Argument: --trace
+Environment Variable: WATCHTOWER_TRACE
+                Type: Boolean
+             Default: false
+```
+
 ## Docker host
 Docker daemon socket to connect to. Can be pointed at a remote Docker host by specifying a TCP endpoint as "tcp://hostname:port".
 
diff --git a/docs/notifications.md b/docs/notifications.md
index 77eba9c..7672c19 100644
--- a/docs/notifications.md
+++ b/docs/notifications.md
@@ -18,8 +18,8 @@ The types of notifications to send are set by passing a comma-separated list of
 
 ## Settings
 
-- `--notifications-level` (env. `WATCHTOWER_NOTIFICATIONS_LEVEL`): Controls the log level which is used for the notifications. If omitted, the default log level is `info`. Possible values are: `panic`, `fatal`, `error`, `warn`, `info` or `debug`.
-- Whatchtower will post a notification every time is started. This behavior [can be changed](https://containrrr.github.io/watchtower/arguments/#without_sending_a_startup_message) with an argument. 
+- `--notifications-level` (env. `WATCHTOWER_NOTIFICATIONS_LEVEL`): Controls the log level which is used for the notifications. If omitted, the default log level is `info`. Possible values are: `panic`, `fatal`, `error`, `warn`, `info`, `debug` or `trace`.
+- Watchtower will post a notification every time it is started. This behavior [can be changed](https://containrrr.github.io/watchtower/arguments/#without_sending_a_startup_message) with an argument. 
 
 ## Available services
 
diff --git a/internal/flags/flags.go b/internal/flags/flags.go
index b460233..20e2cfb 100644
--- a/internal/flags/flags.go
+++ b/internal/flags/flags.go
@@ -84,6 +84,12 @@ func RegisterSystemFlags(rootCmd *cobra.Command) {
 		viper.GetBool("WATCHTOWER_DEBUG"),
 		"enable debug mode with verbose logging")
 
+	flags.BoolP(
+		"trace",
+		"",
+		viper.GetBool("WATCHTOWER_TRACE"),
+		"enable trace mode with very verbose logging - caution, exposes credentials")
+
 	flags.BoolP(
 		"monitor-only",
 		"m",
diff --git a/pkg/registry/registry.go b/pkg/registry/registry.go
index 6bc9604..98eab0e 100644
--- a/pkg/registry/registry.go
+++ b/pkg/registry/registry.go
@@ -16,7 +16,7 @@ func GetPullOptions(imageName string) (types.ImagePullOptions, error) {
 	if auth == "" {
 		return types.ImagePullOptions{}, nil
 	}
-	log.Debugf("Got auth value")
+	log.Tracef("Got auth value: %s", auth)
 
 	return types.ImagePullOptions{
 		RegistryAuth:  auth,
diff --git a/pkg/registry/trust.go b/pkg/registry/trust.go
index c7cc68d..937d2c3 100644
--- a/pkg/registry/trust.go
+++ b/pkg/registry/trust.go
@@ -37,6 +37,7 @@ func EncodedEnvAuth(ref string) (string, error) {
 			Password: password,
 		}
 		log.Debugf("Loaded auth credentials for user %s on registry %s", auth.Username, ref)
+		log.Tracef("Using auth password %s", auth.Password)
 		return EncodeAuth(auth)
 	}
 	return "", errors.New("Registry auth environment variables (REPO_USER, REPO_PASS) not set")
@@ -69,6 +70,7 @@ func EncodedConfigAuth(ref string) (string, error) {
 		return "", nil
 	}
 	log.Debugf("Loaded auth credentials for user %s, on registry %s, from file %s", auth.Username, ref, configFile.Filename)
+	log.Tracef("Using auth password %s", auth.Password)
 	return EncodeAuth(auth)
 }