diff --git a/news/9973.bugfix.rst b/news/9973.bugfix.rst
new file mode 100644
index 00000000000..54309a3014b
--- /dev/null
+++ b/news/9973.bugfix.rst
@@ -0,0 +1 @@
+Mask the user when the password is empty.
diff --git a/src/pip/_internal/utils/misc.py b/src/pip/_internal/utils/misc.py
index 26037dbdcbb..2a81b6b8f31 100644
--- a/src/pip/_internal/utils/misc.py
+++ b/src/pip/_internal/utils/misc.py
@@ -629,12 +629,13 @@ def redact_netloc(netloc):
 
     For example:
         - "user:pass@example.com" returns "user:****@example.com"
+        - "user:@example.com" returns "****@example.com"
         - "accesstoken@example.com" returns "****@example.com"
     """
     netloc, (user, password) = split_auth_from_netloc(netloc)
     if user is None:
         return netloc
-    if password is None:
+    if not password:
         user = "****"
         password = ""
     else: