@dotenvx/dotenvx 2.6.0 → 2.7.1

package/CHANGELOG.md

@@ -2,19 +2,31 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.6.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.7.1...main)
+
+## [2.7.1](https://github.com/dotenvx/dotenvx/compare/v2.7.0...v2.7.1) (2026-07-13)
+
+### Changed
+
+* Security Improvement: `dotenvx armor login` attempts to set the `DOTENVX_ARMOR_TOKEN` in your native OS secret store going forward. For current Armor users run `dotenvx armor logout` and then `dotenvx armor login` to make use of this immediately. ([#886](https://github.com/dotenvx/dotenvx/pull/886))
+
+## [2.7.0](https://github.com/dotenvx/dotenvx/compare/v2.6.0...v2.7.0) (2026-07-13)
+
+### Added
+
+* Added support for `--mask` on `get, run, decrypt` ([#885](https://github.com/dotenvx/dotenvx/pull/885))
 
 ## [2.6.0](https://github.com/dotenvx/dotenvx/compare/v2.5.0...v2.6.0) (2026-07-11)
 
 ### Added
 
-* Support `native up|down|pull|push` for windows ([#834](https://github.com/dotenvx/dotenvx/pull/884))
+* Support `native up|down|pull|push` for windows ([#884](https://github.com/dotenvx/dotenvx/pull/884))
 
 ## [2.5.0](https://github.com/dotenvx/dotenvx/compare/v2.4.2...v2.5.0) (2026-07-11)
 
 ### Added
 
-* Support `native up|down|pull|push` for windows ([#833](https://github.com/dotenvx/dotenvx/pull/883))
+* Support `native up|down|pull|push` for windows ([#883](https://github.com/dotenvx/dotenvx/pull/883))
 
 ## [2.4.1](https://github.com/dotenvx/dotenvx/compare/v2.4.0...v2.4.1) (2026-07-10)
 

package/README.md

@@ -1471,6 +1471,21 @@ $ dotenvx set HELLO Dotenvx -fk .env.keys -f apps/app1/.env
 $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 ```
 
+</details>
+<details><summary>`run --mask`</summary><br>
+
+Inject masked values into the command. By default, up to the first six characters are visible.
+
+```sh
+$ echo "SECRET=abcdefghijkl" > .env
+$ echo "console.log(process.env.SECRET)" > index.js
+
+$ dotenvx run --mask --quiet -- node index.js
+abcdef******
+```
+
+Pass a number to control how many characters are visible, such as `--mask 0` to fully mask values.
+
 </details>
 <details><summary>`run --token`</summary><br>
 
@@ -1510,6 +1525,20 @@ $ dotenvx get HELLO
 World
 ```
 
+</details>
+<details><summary>`get KEY --mask`</summary><br>
+
+Return a masked environment variable value. By default, up to the first six characters are visible.
+
+```sh
+$ echo "SECRET=abcdefghijkl" > .env
+
+$ dotenvx get SECRET --mask
+abcdef******
+```
+
+Pass a number to control how many characters are visible, such as `--mask 0` to fully mask values.
+
 </details>
 <details><summary>`get KEY --no-native`</summary><br>
 
@@ -2141,6 +2170,23 @@ or send to a file:
 $ dotenvx decrypt --stdout > somefile.txt
 ```
 
+</details>
+<details><summary>`decrypt --stdout --mask`</summary><br>
+
+Decrypt the contents of an encrypted `.env` file to stdout with its values masked. The encrypted `.env` file remains unchanged.
+
+```sh
+$ echo "SECRET=abcdefghijkl" > .env
+$ dotenvx encrypt
+◈ encrypted (.env)
+
+$ dotenvx decrypt --stdout --mask
+...
+SECRET="abcdef******"
+```
+
+Pass a number to control how many characters are visible, such as `--mask 0` to fully mask values.
+
 </details>
 <details><summary>`keypair`</summary><br>
 
@@ -2725,6 +2771,33 @@ Hello Dotenvx
 
 It defaults to looking for a `.env` file.
 
+</details>
+<details><summary>`config(mask: true)` - mask</summary><br>
+
+Inject and return masked values. By default, up to the first six characters are visible.
+
+```ini
+# .env
+SECRET="abcdefghijkl"
+```
+
+```js
+// index.js
+const dotenvx = require('@dotenvx/dotenvx')
+const result = dotenvx.config({ mask: true, quiet: true })
+
+console.log(process.env.SECRET)
+console.log(result.parsed.SECRET)
+```
+
+```sh
+$ node index.js
+abcdef******
+abcdef******
+```
+
+Set `mask: 0` to fully mask values.
+
 </details>
 <details><summary>`config(path: ['.env.local', '.env'])` - multiple files</summary><br>
 
@@ -3051,6 +3124,25 @@ console.log(decryptedValue)
 
 This is known as *Decryption at Access* and is written about in [the whitepaper](https://dotenvx.com/dotenvx.pdf).
 
+</details>
+<details><summary>`get(KEY, {mask:})`</summary><br>
+
+Programmatically return a masked environment variable value.
+
+```js
+// index.js
+const dotenvx = require('@dotenvx/dotenvx')
+const maskedValue = await dotenvx.get('SECRET', { mask: true })
+console.log(maskedValue)
+```
+
+```sh
+$ node index.js
+abcdef******
+```
+
+Set `mask: 0` to fully mask values.
+
 </details>
 
 &nbsp;

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.6.0",
+  "version": "2.7.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/decrypt.js

@@ -6,6 +6,7 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 
 const decryptTransform = require('./../../lib/transforms/decrypt')
+const maskEnvSrc = require('../../lib/helpers/maskEnvSrc')
 
 async function decrypt () {
   const options = this.opts()
@@ -44,7 +45,16 @@ async function decrypt () {
         errorCount += 1
         logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
       } else {
-        console.log(processedEnv.envSrc)
+        let showChar = options.mask
+        if (options.mask === true) {
+          showChar = 6
+        }
+
+        let envSrc = processedEnv.envSrc
+        if (options.mask !== undefined) {
+          envSrc = maskEnvSrc(processedEnv.envSrc, showChar)
+        }
+        console.log(envSrc)
       }
     }
 

package/src/cli/actions/get.js

@@ -8,6 +8,7 @@ const getResolver = require('./../../lib/resolvers/get')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
+const mask = require('../../lib/helpers/mask')
 
 async function get (key) {
   const options = normalizeDotenvConfigConvention(this.opts())
@@ -55,6 +56,17 @@ async function get (key) {
     }
 
     if (spinner) spinner.stop()
+    if (options.mask !== undefined) {
+      let showChar = options.mask
+      if (options.mask === true) {
+        showChar = 6
+      }
+
+      for (const key of Object.keys(parsed)) {
+        parsed[key] = mask(parsed[key], showChar)
+      }
+    }
+
     if (key) {
       const single = parsed[key]
       if (single === undefined) {

package/src/cli/actions/run.js

@@ -10,6 +10,9 @@ const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvCon
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
+const mask = require('../../lib/helpers/mask')
+const maskEnvSrc = require('../../lib/helpers/maskEnvSrc')
+const maskProcessedEnvs = require('../../lib/helpers/maskProcessedEnvs')
 
 const { determine } = require('./../../lib/helpers/envResolution')
 
@@ -48,6 +51,12 @@ function uniqueInjectedKeys (processedEnvs) {
 
 async function run () {
   const options = normalizeDotenvConfigConvention(normalizeDotenvConfigQuiet(this.opts()))
+  const maskEnabled = options.mask !== undefined
+  let showChar = options.mask
+  if (options.mask === true) {
+    showChar = 6
+  }
+  let commandEnv = process.env
 
   let commandArgs = this.args
   if (commandArgs.length < 1) {
@@ -56,7 +65,16 @@ async function run () {
 
   const spinner = await createSpinner({ ...options, text: 'injecting' })
 
-  logger.debug(`options: ${JSON.stringify(options)}`)
+  let debugOptions = options
+  if (maskEnabled) {
+    let token = options.token
+    if (options.token) {
+      token = mask(options.token, showChar)
+    }
+
+    debugOptions = { ...options, env: (options.env || []).map(envSrc => maskEnvSrc(envSrc, showChar)), token }
+  }
+  logger.debug(`options: ${JSON.stringify(debugOptions)}`)
   logger.debug(`process command [${commandArgs.join(' ')}]`)
 
   const ignore = options.ignore || []
@@ -103,13 +121,22 @@ async function run () {
       }
     })
 
+    if (maskEnabled) {
+      commandEnv = { ...process.env }
+      maskProcessedEnvs(processedEnvs, commandEnv, showChar)
+    }
+
     for (const processedEnv of processedEnvs) {
       if (processedEnv.type === 'envFile') {
         logger.verbose(`loading env from ${processedEnv.filepath} (${path.resolve(processedEnv.filepath)})`)
       }
 
       if (processedEnv.type === 'env') {
-        logger.verbose(`loading env from string (${processedEnv.string})`)
+        let envString = processedEnv.string
+        if (maskEnabled) {
+          envString = maskEnvSrc(processedEnv.string, showChar)
+        }
+        logger.verbose(`loading env from string (${envString})`)
       }
 
       for (const error of processedEnv.errors || []) {
@@ -161,7 +188,7 @@ async function run () {
     process.exit(1)
   }
 
-  await executeCommand(commandArgs, process.env)
+  await executeCommand(commandArgs, commandEnv)
 }
 
 module.exports = run

package/src/cli/actions/settings/device.js

@@ -0,0 +1,23 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+const mask = require('../../../lib/helpers/mask')
+
+function device () {
+  const options = this.opts()
+
+  try {
+    const value = new Session().devicePublicKey()
+    if (value && value.length > 1) {
+      console.log(options.unmask ? value : mask(value, 6))
+      return
+    }
+
+    logger.error('missing device. Try generating one with [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = device

package/src/cli/actions/settings/hostname.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function hostname () {
+  try {
+    const value = new Session().hostname()
+    if (value && value.length > 1) {
+      console.log(value)
+      return
+    }
+
+    logger.error('missing hostname. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = hostname

package/src/cli/actions/settings/off.js

@@ -0,0 +1,14 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function off () {
+  try {
+    new Session().turnOff()
+    logger.success('✔ armor: off')
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = off

package/src/cli/actions/settings/on.js

@@ -0,0 +1,14 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function on () {
+  try {
+    new Session().turnOn()
+    logger.success('✔ armor: on')
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = on

package/src/cli/actions/settings/path.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function path () {
+  try {
+    const value = new Session().path()
+    if (value && value.length > 1) {
+      console.log(value)
+      return
+    }
+
+    logger.error('missing path. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = path

package/src/cli/actions/settings/token.js

@@ -0,0 +1,23 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+const mask = require('../../../lib/helpers/mask')
+
+function token () {
+  const options = this.opts()
+
+  try {
+    const value = new Session().token()
+    if (value && value.length > 1) {
+      console.log(options.unmask ? value : mask(value))
+      return
+    }
+
+    logger.error('missing token. Try generating one with [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = token

package/src/cli/actions/settings/username.js

@@ -0,0 +1,20 @@
+const { logger } = require('../../../shared/logger')
+const Session = require('../../../db/session')
+
+function username () {
+  try {
+    const value = new Session().username()
+    if (value) {
+      console.log(value)
+      return
+    }
+
+    logger.error('login required. Try running [dotenvx armor login].')
+    process.exit(1)
+  } catch (error) {
+    logger.error(error.message)
+    process.exit(1)
+  }
+}
+
+module.exports = username

package/src/cli/commands/armor.js

@@ -91,6 +91,9 @@ function configureArmorCommand (armor) {
       return require('./../actions/logout').apply(this, args)
     })
 
+  // dotenvx armor settings
+  require('./settings')(armor.command('settings'))
+
   return armor
 }
 

package/src/cli/commands/lock.js

@@ -1,4 +1,10 @@
 function configureLockCommand (lock) {
+  lock.hook('preAction', async () => {
+    const Session = require('./../../db/session')
+    const sesh = new Session()
+    await sesh.notifyUpdate()
+  })
+
   lock
     .description('lock private keys with a local passphrase')
     .action(function () {

package/src/cli/commands/native.js

@@ -1,4 +1,10 @@
 function configureNativeCommand (native) {
+  native.hook('preAction', async () => {
+    const Session = require('./../../db/session')
+    const sesh = new Session()
+    await sesh.notifyUpdate()
+  })
+
   native
     .description('move private keys into your OS secret store')
     .action(function () {

package/src/cli/commands/settings.js

@@ -0,0 +1,62 @@
+function configureSettingsCommand (settings) {
+  settings
+    .description('settings')
+    .action(function () {
+      this.help()
+    })
+
+  settings
+    .command('username')
+    .description('print your username')
+    .action(function (...args) {
+      return require('./../actions/settings/username').apply(this, args)
+    })
+
+  settings
+    .command('token')
+    .description('print your access token (--unmask)')
+    .option('--unmask', 'unmask access token')
+    .action(function (...args) {
+      return require('./../actions/settings/token').apply(this, args)
+    })
+
+  settings
+    .command('device')
+    .description('print your device pubkey (--unmask)')
+    .option('--unmask', 'unmask device pubkey')
+    .action(function (...args) {
+      return require('./../actions/settings/device').apply(this, args)
+    })
+
+  settings
+    .command('hostname')
+    .description('print hostname')
+    .action(function (...args) {
+      return require('./../actions/settings/hostname').apply(this, args)
+    })
+
+  settings
+    .command('path')
+    .description('print path to settings file')
+    .action(function (...args) {
+      return require('./../actions/settings/path').apply(this, args)
+    })
+
+  settings
+    .command('on')
+    .description('turn armor on')
+    .action(function (...args) {
+      return require('./../actions/settings/on').apply(this, args)
+    })
+
+  settings
+    .command('off')
+    .description('turn armor off')
+    .action(function (...args) {
+      return require('./../actions/settings/off').apply(this, args)
+    })
+
+  return settings
+}
+
+module.exports = configureSettingsCommand

package/src/cli/dotenvx.js

@@ -69,6 +69,7 @@ program.command('run')
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('--token <token>', 'set Armor ⛨ token')
+  .option('--mask [characters]', 'inject masked values, optionally setting visible characters')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
   .action(function (...args) {
@@ -89,6 +90,7 @@ program.command('get')
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
   .option('-a, --all', 'include all machine envs as well')
+  .option('--mask [characters]', 'mask values, optionally setting visible characters')
   .option('-pp, --pretty-print', 'pretty print output')
   .option('--pp', 'pretty print output (alias)')
   .option('--format <type>', 'format of the output (json, shell, colon, eval)', 'json')
@@ -146,6 +148,7 @@ program.command('decrypt')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')
   .option('--stdout', 'send to stdout')
+  .option('--mask [characters]', 'mask stdout values, optionally setting visible characters')
   .action(function (...args) {
     this.envs = envs
     return require('./actions/decrypt').apply(this, args)

package/src/db/session.js

@@ -5,6 +5,7 @@ const { Conf, dotenv, envPaths } = require('@dotenvx/tooling')
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const packageJson = require('./../lib/helpers/packageJson')
 const { http } = require('./../lib/helpers/http')
+const nativeProvider = require('./../lib/providers/native')
 const { logger } = require('./../shared/logger')
 
 const HOURS_24 = 60 * 60 * 24 * 1000
@@ -14,7 +15,8 @@ const ARMOR = {
   HOSTNAME: 'DOTENVX_ARMOR_HOSTNAME',
   USER: 'DOTENVX_ARMOR_USER',
   USERNAME: 'DOTENVX_ARMOR_USERNAME',
-  TOKEN: 'DOTENVX_ARMOR_TOKEN'
+  TOKEN: 'DOTENVX_ARMOR_TOKEN',
+  ON: 'DOTENVX_ARMOR_ON'
 }
 
 const DOTENVX = {
@@ -100,7 +102,7 @@ class Session {
 
   status () {
     // if logged in
-    if (this.username() && this.token()) {
+    if (this.username() && this.token() && this.on()) {
       return 'on'
     }
 
@@ -133,7 +135,15 @@ class Session {
   }
 
   token () {
-    return this.readSetting('TOKEN') || undefined
+    return this.getFromSecretStore(ARMOR.TOKEN) || undefined
+  }
+
+  on () {
+    return (this.readSetting('ON') || 'true') === 'true'
+  }
+
+  off () {
+    return (this.readSetting('ON') || 'true') === 'false'
   }
 
   devicePublicKey () {
@@ -187,7 +197,7 @@ class Session {
       store.set(DOTENVX.VERSION_LAST_CHECK, now)
 
       if (versionGreaterThan(remote, packageJson.version)) {
-        console.error('⛆ update available [npm install @dotenvx/dotenvx@latest]')
+        console.error('⛆ update available [curl -sfS https://dotenvx.sh | sh]')
       }
     } catch (error) {
       logger.debug(error.message)
@@ -222,6 +232,47 @@ class Session {
   //
   // Set/Delete
   //
+  getFromSecretStore (key) {
+    try {
+      const value = nativeProvider.get(key)
+      if (value) return value
+    } catch {}
+
+    const store = this.openStore()
+    if (!store) return undefined
+
+    return store.get(key)
+  }
+
+  setInSecretStore (key, value) {
+    try {
+      nativeProvider.set(key, value)
+      return value
+    } catch {
+      this.createStore().set(key, value)
+      return value
+    }
+  }
+
+  deleteFromSecretStore (key) {
+    try {
+      nativeProvider.delete(key)
+    } catch {}
+
+    const store = this.openStore()
+    if (store) store.delete(key)
+  }
+
+  turnOn () {
+    this.createStore().set(ARMOR.ON, 'true')
+    return 'true'
+  }
+
+  turnOff () {
+    this.createStore().set(ARMOR.ON, 'false')
+    return 'false'
+  }
+
   login (hostname, id, username, accessToken) {
     if (!hostname) {
       throw new Error('DOTENVX_ARMOR_HOSTNAME not set. Run [dotenvx armor login]')
@@ -242,8 +293,9 @@ class Session {
     const store = this.createStore()
     store.set(ARMOR.USER, id)
     store.set(ARMOR.USERNAME, username)
-    store.set(ARMOR.TOKEN, accessToken)
+    this.setInSecretStore(ARMOR.TOKEN, accessToken)
     store.set(ARMOR.HOSTNAME, hostname)
+    store.set(ARMOR.ON, 'true')
 
     return accessToken
   }
@@ -261,13 +313,14 @@ class Session {
       throw new Error('DOTENVX_ARMOR_TOKEN not set. Run [dotenvx armor login]')
     }
 
+    this.deleteFromSecretStore(ARMOR.TOKEN)
+
     const store = this.openStore()
     if (!store) return true
-
     store.delete(ARMOR.USER)
     store.delete(ARMOR.USERNAME)
-    store.delete(ARMOR.TOKEN)
     store.delete(ARMOR.HOSTNAME)
+    store.delete(ARMOR.ON)
     store.delete(DOTENVX.VERSION)
     store.delete(DOTENVX.VERSION_LAST_CHECK)
     return true

package/src/lib/helpers/linuxSecretService.js

@@ -7,7 +7,7 @@ function attributes (publicKey) {
   return ['service', SERVICE, 'public-key', publicKey]
 }
 
-function findGenericPassword (publicKey) {
+function get (publicKey) {
   try {
     return execFileSync(SECRET_TOOL_BIN, ['lookup', ...attributes(publicKey)], {
       encoding: 'utf8',
@@ -18,7 +18,7 @@ function findGenericPassword (publicKey) {
   }
 }
 
-function addGenericPassword (publicKey, label, privateKey) {
+function set (publicKey, privateKey, label) {
   try {
     execFileSync(SECRET_TOOL_BIN, ['store', `--label=${label}`, ...attributes(publicKey)], {
       input: privateKey,
@@ -30,14 +30,16 @@ function addGenericPassword (publicKey, label, privateKey) {
   }
 }
 
-function deleteGenericPassword (publicKey) {
-  try {
-    execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
-      stdio: ['ignore', 'ignore', 'pipe']
-    })
-  } catch {
-    throw new Error('failed to delete private key from Linux Secret Service')
+module.exports = {
+  get,
+  set,
+  delete (publicKey) {
+    try {
+      execFileSync(SECRET_TOOL_BIN, ['clear', ...attributes(publicKey)], {
+        stdio: ['ignore', 'ignore', 'pipe']
+      })
+    } catch {
+      throw new Error('failed to delete private key from Linux Secret Service')
+    }
   }
 }
-
-module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/helpers/macosKeychain.js

@@ -0,0 +1,26 @@
+const { execFileSync } = require('child_process')
+
+const SECURITY_BIN = '/usr/bin/security'
+const SERVICE = 'dotenvx'
+
+module.exports = {
+  get (key) {
+    return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', key, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+  },
+
+  set (key, value, label) {
+    try {
+      execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', key, '-l', label, '-w', value], { stdio: 'ignore' })
+    } catch {
+      throw new Error('failed to save private key to macOS Keychain')
+    }
+  },
+
+  delete (key) {
+    try {
+      execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', key], { stdio: 'ignore' })
+    } catch {
+      throw new Error('failed to delete private key from macOS Keychain')
+    }
+  }
+}

package/src/lib/helpers/mask.js

@@ -0,0 +1,22 @@
+function mask (str, showChar = 6) {
+  if (!str || str.length < 1) {
+    return ''
+  }
+
+  const number = Number(showChar)
+  showChar = 0
+  if (Number.isFinite(number)) {
+    showChar = Math.abs(Math.trunc(number))
+  }
+
+  let visibleChars = Math.min(showChar, Math.ceil(str.length / 2))
+  if (str.length === 1) {
+    visibleChars = 0
+  }
+  const visiblePart = str.slice(0, visibleChars)
+  const maskedPart = '*'.repeat(str.length - visibleChars)
+
+  return visiblePart + maskedPart
+}
+
+module.exports = mask

package/src/lib/helpers/maskEnvSrc.js

@@ -0,0 +1,15 @@
+const { scan, upsert } = require('@dotenvx/primitives')
+
+const mask = require('./mask')
+
+function maskEnvSrc (envSrc, showChar) {
+  const { parsed } = scan(envSrc)
+
+  for (const [key, values] of Object.entries(parsed)) {
+    envSrc = upsert(envSrc, key, values.map(value => mask(value, showChar)))
+  }
+
+  return envSrc
+}
+
+module.exports = maskEnvSrc

package/src/lib/helpers/maskProcessedEnvs.js

@@ -0,0 +1,29 @@
+const mask = require('./mask')
+
+function maskProcessedEnvs (processedEnvs, processEnv, showChar) {
+  // Track every key resolved from the requested env sources so the same keys
+  // can also be masked in the environment receiving the resolved values.
+  const resolvedKeys = new Set()
+
+  for (const processedEnv of processedEnvs) {
+    for (const key of Object.keys(processedEnv.parsed || {})) {
+      resolvedKeys.add(key)
+    }
+
+    // These values may be logged, so mask each resolver reporting bucket.
+    for (const values of [processedEnv.parsed, processedEnv.injected, processedEnv.existed]) {
+      for (const key of Object.keys(values || {})) {
+        values[key] = mask(values[key], showChar)
+      }
+    }
+  }
+
+  // Leave unrelated inherited environment variables unchanged.
+  for (const key of resolvedKeys) {
+    if (processEnv[key] !== undefined) {
+      processEnv[key] = mask(processEnv[key], showChar)
+    }
+  }
+}
+
+module.exports = maskProcessedEnvs

package/src/lib/helpers/windowsCredentialManager.js

@@ -134,7 +134,7 @@ function run (payload) {
   })
 }
 
-function findGenericPassword (publicKey) {
+function get (publicKey) {
   try {
     return run({ action: 'read', target: target(publicKey) }).trim() || null
   } catch {
@@ -142,7 +142,7 @@ function findGenericPassword (publicKey) {
   }
 }
 
-function addGenericPassword (publicKey, privateKey) {
+function set (publicKey, privateKey) {
   try {
     run({ action: 'write', target: target(publicKey), username: publicKey, secret: privateKey })
   } catch {
@@ -150,12 +150,14 @@ function addGenericPassword (publicKey, privateKey) {
   }
 }
 
-function deleteGenericPassword (publicKey) {
-  try {
-    run({ action: 'delete', target: target(publicKey) })
-  } catch {
-    throw new Error('failed to delete private key from Windows Credential Manager')
+module.exports = {
+  get,
+  set,
+  delete (publicKey) {
+    try {
+      run({ action: 'delete', target: target(publicKey) })
+    } catch {
+      throw new Error('failed to delete private key from Windows Credential Manager')
+    }
   }
 }
-
-module.exports = { findGenericPassword, addGenericPassword, deleteGenericPassword }

package/src/lib/main.d.ts

@@ -114,6 +114,14 @@ export interface DotenvConfigOptions {
    */
   processEnv?: DotenvPopulateInput;
 
+  /**
+   * Mask resolved values, optionally setting the number of visible characters.
+   * @default false
+   * @example require('@dotenvx/dotenvx').config({ mask: true })
+   * @example require('@dotenvx/dotenvx').config({ mask: 0 })
+   */
+  mask?: boolean | number;
+
   /**
    * Customize the path to your .env.keys file. This is useful with monorepos.
    * @default []
@@ -309,6 +317,14 @@ export function set(
 ): Promise<SetOutput>;
 
 export interface GetOptions {
+  /**
+   * Mask returned values, optionally setting the number of visible characters.
+   * @default false
+   * @example require('@dotenvx/dotenvx').get('KEY', { mask: true })
+   * @example require('@dotenvx/dotenvx').get('KEY', { mask: 0 })
+   */
+  mask?: boolean | number;
+
   /**
    * Suppress specific errors like MISSING_ENV_FILE. The error keys can be found
    * in src/lib/helpers/errors.js

package/src/lib/main.js

@@ -25,6 +25,8 @@ const decryptKeyValue = require('./helpers/cryptography/decryptKeyValue')
 const Errors = require('./helpers/errors')
 const normalizeDotenvConfigQuiet = require('./helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('./helpers/normalizeDotenvConfigConvention')
+const mask = require('./helpers/mask')
+const maskProcessedEnvs = require('./helpers/maskProcessedEnvs')
 
 function uniqueInjectedKeys (processedEnvs) {
   const result = new Set()
@@ -88,6 +90,11 @@ const config = function (options = {}) {
       token: options.token
     })
 
+    if (options.mask !== undefined) {
+      const showChar = options.mask === true ? 6 : options.mask
+      maskProcessedEnvs(processedEnvs, processEnv, showChar)
+    }
+
     let lastError
     /** @type {Record<string, string>} */
     const parsedAll = {}
@@ -326,6 +333,13 @@ const get = async function (key, options = {}) {
     noKeychain
   })
 
+  if (options.mask !== undefined) {
+    const showChar = options.mask === true ? 6 : options.mask
+    for (const key of Object.keys(parsed)) {
+      parsed[key] = mask(parsed[key], showChar)
+    }
+  }
+
   for (const error of errors || []) {
     if (ignore.includes(error.code)) {
       continue // ignore error

package/src/lib/providers/native/index.js

@@ -1,27 +1,52 @@
-const { execFileSync } = require('child_process')
-
+const macosKeychain = require('../../helpers/macosKeychain')
 const windowsCredentialManager = require('../../helpers/windowsCredentialManager')
 const linuxSecretService = require('../../helpers/linuxSecretService')
 
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
+function get (key) {
+  if (process.platform === 'win32') {
+    return windowsCredentialManager.get(key)
+  }
 
-function findMacosPrivateKey (publicKeyHex) {
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKeyHex, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
+  if (process.platform === 'linux') {
+    return linuxSecretService.get(key)
+  }
+
+  return macosKeychain.get(key)
+}
+
+function set (key, value, label = key) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.set(key, value, label)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.set(key, value, label)
+    return
+  }
+
+  macosKeychain.set(key, value, label)
+}
+
+index.delete = function (key) {
+  if (process.platform === 'win32') {
+    windowsCredentialManager.delete(key)
+    return
+  }
+
+  if (process.platform === 'linux') {
+    linuxSecretService.delete(key)
+    return
+  }
+
+  macosKeychain.delete(key)
 }
 
 function index (publicKeyHex) {
   if (!['darwin', 'linux', 'win32'].includes(process.platform)) return {}
 
   try {
-    let privateKeyHex
-    if (process.platform === 'win32') {
-      privateKeyHex = windowsCredentialManager.findGenericPassword(publicKeyHex)
-    } else if (process.platform === 'linux') {
-      privateKeyHex = linuxSecretService.findGenericPassword(publicKeyHex)
-    } else {
-      privateKeyHex = findMacosPrivateKey(publicKeyHex)
-    }
+    const privateKeyHex = get(publicKeyHex)
 
     if (!privateKeyHex) return {}
 
@@ -31,4 +56,7 @@ function index (publicKeyHex) {
   }
 }
 
+index.set = set
+index.get = get
+
 module.exports = index

package/src/lib/services/keychainDown.js

@@ -1,40 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
-
-function deleteGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.deleteGenericPassword(publicKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.deleteGenericPassword(publicKey)
-    return
-  }
-
-  execFileSync(SECURITY_BIN, ['delete-generic-password', '-s', SERVICE, '-a', publicKey], { stdio: 'ignore' })
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainDown {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -55,7 +23,7 @@ class KeychainDown {
     let privateKey
 
     try {
-      privateKey = findGenericPassword(publicKey)
+      privateKey = nativeProvider.get(publicKey)
       if (!privateKey) {
         const secretStore = process.platform === 'win32'
           ? 'Windows Credential Manager'
@@ -78,7 +46,7 @@ class KeychainDown {
     }
 
     upsertEnvKey(privateKeyName, privateKey, envKeysFile)
-    deleteGenericPassword(publicKey)
+    nativeProvider.delete(publicKey)
 
     return {
       changed: true,

package/src/lib/services/keychainPull.js

@@ -1,26 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const upsertEnvKey = require('../helpers/upsertEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainPull {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -41,7 +23,7 @@ class KeychainPull {
     let privateKey
 
     try {
-      privateKey = findGenericPassword(publicKey)
+      privateKey = nativeProvider.get(publicKey)
       if (!privateKey) throw new Error('not found')
     } catch {
       const secretStore = process.platform === 'win32'

package/src/lib/services/keychainPush.js

@@ -1,43 +1,7 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function addGenericPassword (publicKey, label, privateKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
-    return
-  }
-
-  try {
-    execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
-  } catch {
-    throw new Error('failed to save private key to macOS Keychain')
-  }
-}
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainPush {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -59,7 +23,7 @@ class KeychainPush {
     const label = `dotenvx (${armoredKeyDisplay(publicKey)})`
 
     try {
-      const existingPrivateKey = findGenericPassword(publicKey)
+      const existingPrivateKey = nativeProvider.get(publicKey)
 
       if (existingPrivateKey === privateKey) {
         return {
@@ -72,7 +36,7 @@ class KeychainPush {
       }
     } catch {}
 
-    addGenericPassword(publicKey, label, privateKey)
+    nativeProvider.set(publicKey, privateKey, label)
 
     return {
       changed: true,

package/src/lib/services/keychainUp.js

@@ -1,44 +1,8 @@
-const { execFileSync } = require('child_process')
-
 const keynames = require('../conventions/keynames')
 const readEnvKey = require('../helpers/readEnvKey')
 const removeEnvKey = require('../helpers/removeEnvKey')
 const armoredKeyDisplay = require('../helpers/armoredKeyDisplay')
-const windowsCredentialManager = require('../helpers/windowsCredentialManager')
-const linuxSecretService = require('../helpers/linuxSecretService')
-
-const SECURITY_BIN = '/usr/bin/security'
-const SERVICE = 'dotenvx'
-
-function addGenericPassword (publicKey, label, privateKey) {
-  if (process.platform === 'win32') {
-    windowsCredentialManager.addGenericPassword(publicKey, privateKey)
-    return
-  }
-
-  if (process.platform === 'linux') {
-    linuxSecretService.addGenericPassword(publicKey, label, privateKey)
-    return
-  }
-
-  try {
-    execFileSync(SECURITY_BIN, ['add-generic-password', '-U', '-s', SERVICE, '-a', publicKey, '-l', label, '-w', privateKey], { stdio: 'ignore' })
-  } catch {
-    throw new Error('failed to save private key to macOS Keychain')
-  }
-}
-
-function findGenericPassword (publicKey) {
-  if (process.platform === 'win32') {
-    return windowsCredentialManager.findGenericPassword(publicKey)
-  }
-
-  if (process.platform === 'linux') {
-    return linuxSecretService.findGenericPassword(publicKey)
-  }
-
-  return execFileSync(SECURITY_BIN, ['find-generic-password', '-s', SERVICE, '-a', publicKey, '-w'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim()
-}
+const nativeProvider = require('../providers/native')
 
 class KeychainUp {
   constructor (envFile = '.env', envKeysFile = '.env.keys') {
@@ -60,7 +24,7 @@ class KeychainUp {
     let existingPrivateKey
 
     try {
-      existingPrivateKey = findGenericPassword(publicKey)
+      existingPrivateKey = nativeProvider.get(publicKey)
     } catch {}
 
     const privateKey = readEnvKey(privateKeyName, envKeysFile, { strict: !existingPrivateKey })
@@ -89,7 +53,7 @@ class KeychainUp {
       }
     }
 
-    addGenericPassword(publicKey, label, privateKey)
+    nativeProvider.set(publicKey, privateKey, label)
     removeEnvKey(privateKeyName, envKeysFile)
 
     return {