@@ -672,9 +672,9 @@ def _redact_url_credentials(text: str) -> Optional[str]:
 def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
     """Redact credentials in URLs and HTTP Authorization extra headers in a command line.
 
-    URLs are also redacted when they are the value of a configuration assignment, such
-    as ``http.proxy=<url>``, and assignments are recognized in both the ``-c <key>=<value>``
-    and the ``--config=<key>=<value>`` form.
+    URLs are also redacted in the key and value of a configuration assignment, such
+    as ``http.proxy=<url>``. Assignments are recognized in the ``-c <key>=<value>``,
+    ``-c<key>=<value>``, and ``--config=<key>=<value>`` forms.
 
     If nothing is found, this just returns the command line as-is.
 
@@ -683,8 +683,15 @@ def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
     """
     new_cmdline = []
     for to_parse in cmdline:
-        option = "--config=" if to_parse.startswith("--config=") else ""
+        if to_parse.startswith("--config="):
+            option = "--config="
+        elif to_parse.startswith("-c"):
+            option = "-c"
+        else:
+            option = ""
         assignment = to_parse[len(option) :]
+        # Redact the whole URL first, before splitting on a possible '=' in userinfo.
+        assignment = _redact_url_credentials(assignment) or assignment
         config_key, separator, value = assignment.partition("=")
         header_name, colon, _ = value.partition(":")
         if (
@@ -696,16 +703,9 @@ def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
             new_cmdline.append("%s%s%s%s%s *****" % (option, config_key, separator, header_name, colon))
             continue
 
-        redacted = _redact_url_credentials(to_parse)
-        if redacted is None and option:
-            redacted = _redact_url_credentials(assignment)
-            if redacted is not None:
-                redacted = option + redacted
-        if redacted is None and separator:
-            redacted = _redact_url_credentials(value)
-            if redacted is not None:
-                redacted = option + config_key + separator + redacted
-        new_cmdline.append(to_parse if redacted is None else redacted)
+        if separator:
+            value = _redact_url_credentials(value) or value
+        new_cmdline.append(option + config_key + separator + value)
     return new_cmdline
 
 
 
@@ -10,7 +10,6 @@
 import logging
 import os
 import os.path as osp
-from pathlib import Path
 import pickle
 import re
 import shutil
@@ -20,14 +19,14 @@
 import tempfile
 import threading
 import time
+from pathlib import Path
 from unittest import mock, skipUnless
 
 import ddt
 
 from git import Git, GitCommandError, GitCommandNotFound, Repo, cmd, refresh
 from git.exc import UnsafeOptionError
 from git.util import cwd, finalize_process
-
 from test.lib import TestBase, fixture_path, with_rw_directory
 
 
@@ -547,6 +546,38 @@ def test_it_redacts_authorization_extra_header_from_error(self):
         self.assertNotIn(token, message)
         self.assertIn("http.extraHeader=Authorization: *****", message)
 
+    @ddt.data(
+        (
+            "--config=http.https://alice@host.proxy=http://bob:token@proxy",
+            "--config=http.https://*****@host.proxy=http://*****:*****@proxy",
+        ),
+        (
+            "-curl.https://user:token@host/.insteadOf=https://old/",
+            "-curl.https://*****:*****@host/.insteadOf=https://old/",
+        ),
+    )
+    @ddt.unpack
+    def test_clone_redacts_config_urls_from_trace_and_error(self, option, expected):
+        for trace in (True, "full"):
+            with self.subTest(trace=trace), tempfile.TemporaryDirectory() as directory:
+                with mock.patch.object(Git, "GIT_PYTHON_TRACE", trace):
+                    with self.assertLogs("git.cmd", level="INFO") as logs:
+                        with self.assertRaises(GitCommandError) as context:
+                            Repo.clone_from(
+                                osp.join(directory, "missing-source"),
+                                osp.join(directory, "destination"),
+                                multi_options=[option],
+                                allow_unsafe_options=True,
+                            )
+                self.assertIn(expected, context.exception.command)
+                message = str(context.exception)
+                assert logs is not None
+                log_output = " ".join(logs.output)
+                self.assertIn(expected, log_output)
+                for credential in ("alice", "bob", "user", "token"):
+                    self.assertNotIn(credential, message)
+                    self.assertNotIn(credential, log_output)
+
     def test_it_accepts_environment_variables(self):
         filename = fixture_path("ls_tree_empty")
         with open(filename, "r") as fh:
 
@@ -849,6 +849,7 @@ def test_remove_empty_password_keeps_host_intact(self):
         ("//user:pass@[2001:db8::1]:0080/repo", "//*****:*****@[2001:db8::1]:0080/repo"),
         ("https://user:p@ss@example.com/repo", "https://*****:*****@example.com/repo"),
         ("https://user:@example.com/repo", "https://*****:*****@example.com/repo"),
+        ("https://user:p=ass@example.com/repo", "https://*****:*****@example.com/repo"),
         ("https://@example.com/repo", "https://*****@example.com/repo"),
         ("https://example.com/repo@name?q=a@b#c@d", "https://example.com/repo@name?q=a@b#c@d"),
     )
@@ -877,7 +878,36 @@ def test_remove_password_preserves_url_components(self, url, expected):
             ["--config=http.extraHeader=Authorization: Bearer pass"],
             ["--config=http.extraHeader=Authorization: *****"],
         ),
+        (
+            ["--config=http.https://alice@host.proxy=http://bob:token@proxy"],
+            ["--config=http.https://*****@host.proxy=http://*****:*****@proxy"],
+        ),
+        (
+            ["-c", "http.https://alice@host.proxy=http://bob:token@proxy"],
+            ["-c", "http.https://*****@host.proxy=http://*****:*****@proxy"],
+        ),
+        (
+            ["-chttp.https://alice@host.proxy=http://bob:token@proxy"],
+            ["-chttp.https://*****@host.proxy=http://*****:*****@proxy"],
+        ),
+        (
+            ["-curl.https://user:token@host/.insteadOf=https://old/"],
+            ["-curl.https://*****:*****@host/.insteadOf=https://old/"],
+        ),
+        (
+            ["-chttp.proxy=http://bob:token@proxy"],
+            ["-chttp.proxy=http://*****:*****@proxy"],
+        ),
+        (
+            ["--config=http.https://alice:token@host/.extraHeader=Authorization: Bearer pass"],
+            ["--config=http.https://*****:*****@host/.extraHeader=Authorization: *****"],
+        ),
+        (
+            ["-chttp.extraHeader=Authorization: Bearer pass"],
+            ["-chttp.extraHeader=Authorization: *****"],
+        ),
         (["-c", "user.name=pass"], ["-c", "user.name=pass"]),
+        (["-cuser.name=pass"], ["-cuser.name=pass"]),
     )
     @ddt.unpack
     def test_remove_password_from_config_values(self, cmdline, expected):