diff --git a/app/api/v1/base/base.py b/app/api/v1/base/base.py
index 4850ede..1af9383 100644
--- a/app/api/v1/base/base.py
+++ b/app/api/v1/base/base.py
@@ -41,8 +41,7 @@ async def login_access_token(credentials: CredentialsSchema):
 async def get_userinfo():
     user_id = CTX_USER_ID.get()
     user_obj = await user_controller.get(id=user_id)
-    data = await user_obj.to_dict()
-    data.pop("password")
+    data = await user_obj.to_dict(exclude_fields=["password"])
     data["avatar"] = "https://avatars.githubusercontent.com/u/54677442?v=4"
     return Success(data=data)
 
diff --git a/app/api/v1/users/users.py b/app/api/v1/users/users.py
index 94c00a3..241c1f0 100644
--- a/app/api/v1/users/users.py
+++ b/app/api/v1/users/users.py
@@ -28,7 +28,7 @@ async def list_user(
     if email:
         q &= Q(email__contains=email)
     total, user_objs = await user_controller.list(page=page, page_size=page_size, search=q)
-    data = [await obj.to_dict(m2m=True) for obj in user_objs]
+    data = [await obj.to_dict(m2m=True, exclude_fields=["password"]) for obj in user_objs]
     return SuccessExtra(data=data, total=total, page=page, page_size=page_size)
 
 
@@ -38,7 +38,7 @@ async def get_user(
 ):
     user_controller = UserController()
     user_obj = await user_controller.get(id=user_id)
-    user_dict = await user_obj.to_dict()
+    user_dict = await user_obj.to_dict(exclude_fields=["password"])
     return Success(data=user_dict)
 
 
diff --git a/app/models/base.py b/app/models/base.py
index 51e5c05..e88ab8d 100644
--- a/app/models/base.py
+++ b/app/models/base.py
@@ -8,21 +8,28 @@ from app.settings import settings
 class BaseModel(models.Model):
     id = fields.BigIntField(pk=True, index=True)
 
-    async def to_dict(self, m2m=False):
+    async def to_dict(self, m2m: bool = False, exclude_fields: list[str] | None = None):
+        if exclude_fields is None:
+            exclude_fields = []
+
         d = {}
         for field in self._meta.db_fields:
-            value = getattr(self, field)
-            if isinstance(value, datetime):
-                value = value.strftime(settings.DATETIME_FORMAT)
-            d[field] = value
+            if field not in exclude_fields:
+                value = getattr(self, field)
+                if isinstance(value, datetime):
+                    value = value.strftime(settings.DATETIME_FORMAT)
+                d[field] = value
         if m2m:
             for field in self._meta.m2m_fields:
-                values = [value for value in await getattr(self, field).all().values()]
-                for value in values:
-                    value.update(
-                        (k, v.strftime(settings.DATETIME_FORMAT)) for k, v in value.items() if isinstance(v, datetime)
-                    )
-                d[field] = values
+                if field not in exclude_fields:
+                    values = [value for value in await getattr(self, field).all().values()]
+                    for value in values:
+                        value.update(
+                            (k, v.strftime(settings.DATETIME_FORMAT))
+                            for k, v in value.items()
+                            if isinstance(v, datetime)
+                        )
+                    d[field] = values
         return d
 
     class Meta: