diff --git a/.changeset/smart-berries-wash.md b/.changeset/smart-berries-wash.md
new file mode 100644
index 0000000000..8d1454c837
--- /dev/null
+++ b/.changeset/smart-berries-wash.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-devtools': patch
+---
+
+Added note to README about how secrets are displayed in the Config tab of the DevTools plugin
diff --git a/plugins/devtools/README.md b/plugins/devtools/README.md
index 26226d2976..c5aa86ce25 100644
--- a/plugins/devtools/README.md
+++ b/plugins/devtools/README.md
@@ -16,6 +16,8 @@ Lists helpful information about your current running Backstage instance such as:
 
 Lists the configuration being used by your current running Backstage instance.
 
+**Note:** The Config tab uses the configuration schema [defined by each plugin](https://backstage.io/docs/conf/defining) to be able to mask secrets. It does this by checking that the [visibility](https://backstage.io/docs/conf/defining#visibility) has been marked as `secret`. If this is not set then the secret will appear in clear text. To avoid this it is highly recommended that you enable the [permission framework](https://backstage.io/docs/permissions/overview) and [apply the proper permissions](#permissions)).
+
 ![Example of Config tab](./docs/devtools-config-tab.png)
 
 ## Optional Features