diff --git a/bin/docker-entry.sh b/bin/docker-entry.sh
index 3f0ea8d47..83ee58c76 100755
--- a/bin/docker-entry.sh
+++ b/bin/docker-entry.sh
@@ -12,16 +12,16 @@ blockproducer)
     exec /app/cqld -config "${COVENANT_CONF}" -metric-web "${METRIC_WEB_ADDR}" "${@}"
     ;;
 observer)
-    exec /app/cql explorer -config "${COVENANT_CONF}" -no-password "${COVENANTSQL_OBSERVER_ADDR}" "${@}"
+    exec /app/cql explorer -config "${COVENANT_CONF}" "${COVENANTSQL_OBSERVER_ADDR}" "${@}"
     ;;
 adapter)
-    exec /app/cql adapter -config "${COVENANT_CONF}" -no-password "${COVENANTSQL_ADAPTER_ADDR}" "${@}"
+    exec /app/cql adapter -config "${COVENANT_CONF}" "${COVENANTSQL_ADAPTER_ADDR}" "${@}"
     ;;
 mysql-adapter)
     exec /app/cql-mysql-adapter -config "${COVENANT_CONF}" "${@}"
     ;;
 cli)
-    exec /app/cql console -config ${COVENANT_CONF} -no-password "${@}"
+    exec /app/cql console -config ${COVENANT_CONF} "${@}"
     ;;
 faucet)
     exec /app/cql-faucet -config ${COVENANT_CONF} "${@}"
diff --git a/cmd/cql/internal/cfg.go b/cmd/cql/internal/cfg.go
index 95404d9e9..d63b4571e 100644
--- a/cmd/cql/internal/cfg.go
+++ b/cmd/cql/internal/cfg.go
@@ -44,7 +44,7 @@ import (
 var (
 	configFile      string
 	password        string
-	noPassword      bool
+	withPassword    bool
 	consoleLogLevel string // foreground console log level
 
 	waitTxConfirmation bool // wait for transaction confirmation before exiting
@@ -56,12 +56,12 @@ var (
 
 func addCommonFlags(cmd *Command) {
 	cmd.CommonFlag.BoolVar(&help, "help", false, "Show help message")
-	cmd.CommonFlag.BoolVar(&noPassword, "no-password", true,
-		"Use empty password for master key")
+	cmd.CommonFlag.BoolVar(&withPassword, "with-password", false,
+		"Input passphrase for encrypting private.key")
 
 	// debugging flags.
 	cmd.DebugFlag.StringVar(&password, "password", "",
-		"Master key password for covenantsql (NOT SAFE, for debug or script only)")
+		"Passphrase for encrypting private.key (NOT SAFE, for debug or script only)")
 	cmd.DebugFlag.StringVar(&consoleLogLevel, "log-level", "info",
 		"Console log level: trace debug info warning error fatal panic")
 	cmd.DebugFlag.BoolVar(&asymmetric.BypassSignature, "bypass-signature", false,
@@ -83,14 +83,14 @@ func commonFlagsInit(cmd *Command) {
 
 func addConfigFlag(cmd *Command) {
 	cmd.CommonFlag.StringVar(&configFile, "config", "~/.cql/config.yaml",
-		"Config file for covenantsql (Usually no need to set, default is enough.)")
+		"Config file for CovanantSQL (Usually no need to set, default is enough.)")
 }
 
 func configInit() {
 	configFile = utils.HomeDirExpand(configFile)
 
 	if password == "" {
-		password = readMasterKey(noPassword)
+		password = readMasterKey(!withPassword)
 	}
 
 	// init covenantsql driver
diff --git a/cmd/cql/internal/generate.go b/cmd/cql/internal/generate.go
index f41fc067f..fe66114d0 100644
--- a/cmd/cql/internal/generate.go
+++ b/cmd/cql/internal/generate.go
@@ -43,13 +43,13 @@ var CmdGenerate = &Command{
 	Short:     "generate a folder contains config file and private key",
 	Long: `
 Generate generates private.key and config.yaml for CovenantSQL.
-You can input a passphrase for local encrypt your private key file by set -no-password=false
+You can input a passphrase for local encrypt your private key file by set -with-password
 e.g.
     cql generate
 
 or input a passphrase by
 
-    cql generate -no-password=false
+    cql generate -with-password
 `,
 }
 
@@ -132,7 +132,7 @@ func runGenerate(cmd *Command, args []string) {
 
 		if password == "" {
 			fmt.Println("Please enter the password of the existing private key")
-			oldPassword = readMasterKey(noPassword)
+			oldPassword = readMasterKey(!withPassword)
 		} else {
 			oldPassword = password
 		}
@@ -179,7 +179,7 @@ func runGenerate(cmd *Command, args []string) {
 	fmt.Println("Generating private key...")
 	if password == "" {
 		fmt.Println("Please enter password for new private key")
-		password = readMasterKey(noPassword)
+		password = readMasterKey(!withPassword)
 	}
 
 	if privateKeyParam == "" {
@@ -287,6 +287,6 @@ You can get some free PTC from:
 	fmt.Println(walletAddr)
 
 	if password != "" {
-		fmt.Println("Your private key had been encrypted by a passphrase, add -no-password=false in any further command")
+		fmt.Println("Your private key had been encrypted by a passphrase, add -with-password in any further command")
 	}
 }
diff --git a/sqlchain/mirror/mirror_test.go b/sqlchain/mirror/mirror_test.go
index 0cc8759d0..637f37f58 100644
--- a/sqlchain/mirror/mirror_test.go
+++ b/sqlchain/mirror/mirror_test.go
@@ -273,7 +273,6 @@ func TestFullProcess(t *testing.T) {
 			[]string{"-test.coverprofile", FJ(baseDir, "./cmd/cql/mirror.cover.out"),
 				"mirror",
 				"-config", FJ(testWorkingDir, "./mirror/node_mirror/config.yaml"),
-				"-no-password",
 				"-bg-log-level", "debug",
 				dsnCfg.DatabaseID,
 				"127.0.0.1:5663",
diff --git a/sqlchain/observer/observation_test.go b/sqlchain/observer/observation_test.go
index 151d1ac27..f03f2f7a4 100644
--- a/sqlchain/observer/observation_test.go
+++ b/sqlchain/observer/observation_test.go
@@ -489,7 +489,6 @@ func TestFullProcess(t *testing.T) {
 			[]string{"-test.coverprofile", FJ(baseDir, "./cmd/cql/observer.cover.out"),
 				"explorer",
 				"-config", FJ(testWorkingDir, "./observation/node_observer/config.yaml"),
-				"-no-password",
 				"-bg-log-level", "debug",
 				"127.0.0.1:4663",
 			},
@@ -720,7 +719,6 @@ func TestFullProcess(t *testing.T) {
 			[]string{"-test.coverprofile", FJ(baseDir, "./cmd/cql/observer.cover.out"),
 				"explorer",
 				"-config", FJ(testWorkingDir, "./observation/node_observer/config.yaml"),
-				"-no-password",
 				"-bg-log-level", "debug",
 				"127.0.0.1:4663",
 			},