diff --git a/lib/config/decrypt.js b/lib/config/decrypt.js
index 939d40d31f15a3e7299e54f67ca54eb878d1713e..17c0d8aaa7a3e23fe0c5758526204f4055484aa1 100644
--- a/lib/config/decrypt.js
+++ b/lib/config/decrypt.js
@@ -1,6 +1,6 @@
 const is = require('@sindresorhus/is');
 const crypto = require('crypto');
-const { maskToken } = require('../datasource/npm');
+const { maskToken } = require('../util/mask');
 
 module.exports = {
   decryptConfig,
diff --git a/lib/datasource/npm/get.js b/lib/datasource/npm/get.js
index fd7b996388212074480c67a228b8f022fbb9fa31..21b76c40390cb36b8dd67e94f7fcf20766687ce7 100644
--- a/lib/datasource/npm/get.js
+++ b/lib/datasource/npm/get.js
@@ -8,9 +8,8 @@ const parse = require('github-url-from-git');
 const { isBase64 } = require('validator');
 
 const hostRules = require('../../util/host-rules');
-
+const { maskToken } = require('../../util/mask');
 const { getNpmrc } = require('./npmrc');
-const { maskToken } = require('./mask');
 
 module.exports = {
   getDependency,
diff --git a/lib/datasource/npm/index.js b/lib/datasource/npm/index.js
index 7c2790ee6f0a683ea804921c0166d4e3905930b4..5485934deb3e4c1477a16768aaa681ca34debd8b 100644
--- a/lib/datasource/npm/index.js
+++ b/lib/datasource/npm/index.js
@@ -1,11 +1,9 @@
 const { resetMemCache, resetCache } = require('./get');
 const { getPreset } = require('./presets');
 const { getPkgReleases } = require('./releases');
-const { maskToken } = require('./mask');
 const { setNpmrc } = require('./npmrc');
 
 module.exports = {
-  maskToken,
   setNpmrc,
   getPreset,
   getPkgReleases,
diff --git a/lib/datasource/npm/mask.js b/lib/datasource/npm/mask.js
deleted file mode 100644
index 485908695043ddec02e2b993bc6753ca9db841eb..0000000000000000000000000000000000000000
--- a/lib/datasource/npm/mask.js
+++ /dev/null
@@ -1,14 +0,0 @@
-module.exports = {
-  maskToken,
-};
-
-// istanbul ignore next
-function maskToken(token) {
-  // istanbul ignore if
-  if (!token) {
-    return token;
-  }
-  return `${token.substring(0, 2)}${new Array(token.length - 3).join(
-    '*'
-  )}${token.slice(-2)}`;
-}
diff --git a/lib/platform/github/gh-got-wrapper.js b/lib/platform/github/gh-got-wrapper.js
index be130dd773b812a27eeb295c6a5e1e61730436ee..2981afa92df32126d572b3bf22b8d680413b9e9d 100644
--- a/lib/platform/github/gh-got-wrapper.js
+++ b/lib/platform/github/gh-got-wrapper.js
@@ -3,6 +3,7 @@ const ghGot = require('gh-got');
 const delay = require('delay');
 const parseLinkHeader = require('parse-link-header');
 const hostRules = require('../../util/host-rules');
+const { maskToken } = require('../../util/mask');
 
 let cache = {};
 let stats = {};
@@ -196,16 +197,6 @@ async function get(path, options, retries = 5) {
   }
 }
 
-// istanbul ignore next
-function maskToken(token) {
-  if (!token) {
-    return token;
-  }
-  return `${token.substring(0, 2)}${new Array(token.length - 3).join(
-    '*'
-  )}${token.slice(-2)}`;
-}
-
 const helpers = ['get', 'post', 'put', 'patch', 'head', 'delete'];
 
 for (const x of helpers) {
diff --git a/lib/util/mask.js b/lib/util/mask.js
new file mode 100644
index 0000000000000000000000000000000000000000..0329f22970a8b8633ddfb4e5917cac2737f142fe
--- /dev/null
+++ b/lib/util/mask.js
@@ -0,0 +1,13 @@
+function maskToken(str) {
+  return str
+    ? [
+        str.substring(0, 2),
+        new Array(str.length - 3).join('*'),
+        str.slice(-2),
+      ].join('')
+    : str;
+}
+
+module.exports = {
+  maskToken,
+};
diff --git a/test/util/mask.spec.js b/test/util/mask.spec.js
new file mode 100644
index 0000000000000000000000000000000000000000..ea7f199dcfca3b4ed9718821bee28a1281f0dd2f
--- /dev/null
+++ b/test/util/mask.spec.js
@@ -0,0 +1,13 @@
+const { maskToken } = require('../../lib/util/mask');
+
+describe('util/mask', () => {
+  describe('.maskToken', () => {
+    it('returns value if passed value is falsy', () => {
+      expect(maskToken('')).toEqual('');
+    });
+
+    it('hides value content', () => {
+      expect(maskToken('123456789')).toEqual('12*****89');
+    });
+  });
+});