dotenvx decrypt --stdout --mask

Decrypt an encrypted .env file to stdout with its values masked.

The encrypted .env file remains unchanged. By default, up to the first six characters are visible.

$ echo "SECRET=abcdefghijkl" > .env
$ dotenvx encrypt
◈ encrypted (.env)

$ dotenvx decrypt --stdout --mask
...
SECRET="abcdef******"

Pass a number to control how many characters are visible, such as --mask 0 to fully mask values.