What's the smallest privileges required for pt-show-grants?

I used pt-show-grants in B machine to dump A machine’s privileges,and B machine’s user has select privileges to A machine,but generated file doesn’t print password information ,like this:

but I run pt-show-grants in A machine using root user,then password information would be contained,like this:

So what’s the smallest privileges required by pt-show-grants?

It seems like the minimum privilege for a user would be SELECT on mysql.*

GRANT SELECT ON mysql.* TO 'username'@'hostname' IDENTIFIED BY 'somepassword';