By default, open a .env file and its values start masked.

Click Toggle auto-cloaking at the top of the file or run Dotenv: Toggle auto-cloaking from the Command Palette to reveal or hide them.

Switching tabs hides them again in the Dotenv Editor when auto-cloaking is enabled. Set dotenv.enableAutocloaking to false to keep values visible, including after reopening files or switching tabs. This disables the cloaking feature and removes its toggle controls. Changes apply to open editors immediately.

.env, .env.example, .env.development, .env.staging, .env.production, other .env.* files, *.env, and .flaskenv are supported.

Start typing process.env. or your language's environment-variable expression.

Suggestions come from your dotenv files, with values masked and source filenames shown.

Open a suggestion's details and click Reveal value. Click Hide value to mask it again.

Only that source's value is revealed. The suggestion row stays masked, and your secret-peeking setting stays unchanged.

Hover over a reference such as process.env.SECRET_KEY or ENV["SECRET_KEY"].

Every new hover or expanded autocomplete peek starts cloaked. Click Reveal value to reveal that popup, or Hide value to cloak it again. Editor cloaking toggles never reveal peek values. Uncheck Dotenv: Enable Secretpeeking to disable dotenv hovers and in-code Reveal actions, including the expanded value details in autocomplete. Completion suggestions remain available with masked values.

In the Dotenv Editor, hover over an encrypted: value and click Decrypt value. The file stays encrypted.

Click Hide value, leave the popup, or switch tabs to clear the displayed plaintext.

You'll need a saved file, a trusted workspace, and the dotenvx CLI installed locally. The CLI isn't bundled with this extension.

Install it using the dotenvx installation instructions.

dotenvx finds the matching private key through its usual lookup, such as .env.keys or its key store. A key stored only in GitHub Actions isn't available locally.

If dotenvx isn't on your PATH, set dotenv.dotenvxPath to its executable.

Variable names, values, comments, and quoted strings have syntax highlighting. The Dotenv Editor also highlights numeric values.

Auto-completion and secret peeking support JavaScript, TypeScript, Ruby, Python, PHP, Go, Java, .NET (C#, F#, Visual Basic), C/C++, Julia, Erlang, Perl, Swift, Clojure, Rust, Dart, Kotlin, and Elixir.

Values come from your dotenv files, rather than the running application's environment.

Both node:process and process imports work, including named aliases and multiline imports.

import { env } from 'node:process'
console.log(env.SECRET_KEY)

import { env as environment } from 'node:process'
console.log(environment.SECRET_KEY)

C#, F#, and Visual Basic support Environment.GetEnvironmentVariable, including System.Environment and the overload with an EnvironmentVariableTarget.

Type ( or " in the first argument, or request completion while typing a name. Hover over the name to peek at its value.

var secret = System.Environment.GetEnvironmentVariable("SECRET_KEY");

Values come from dotenv files. The extension doesn't read Windows registry values, appsettings.json, or IConfiguration.

Complete and hover over names in getenv calls. C++ also supports std::getenv and ::getenv.

const char *secret = getenv("SECRET_KEY");

Complete and hover over names in these expressions:

secret = ENV["SECRET_KEY"]
secret = get(ENV, "SECRET_KEY", "fallback")

Secret = os:getenv("SECRET_KEY").
Secret = os:getenv("SECRET_KEY", "fallback").

Erlang files need the erlang language mode provided by an Erlang extension. Fallback arguments aren't evaluated when a key is missing from your dotenv files.

Suggestions preserve bare keys, single quotes, or double quotes. Hover over a name to peek at its value.

my $secret = $ENV{SECRET_KEY};
my $secret = $ENV{'SECRET_KEY'};
my $secret = $ENV{"SECRET_KEY"};

Complete names inside quotes and hover over them to peek at their values.

let secret = ProcessInfo.processInfo.environment["SECRET_KEY"]
let secret = getenv("SECRET_KEY")

Swift also supports Foundation.ProcessInfo.processInfo.environment, Darwin.getenv, and Glibc.getenv.

(System/getenv "SECRET_KEY")
(java.lang.System/getenv "SECRET_KEY")

Completion and secret peeking look in the source file's directory and each parent directory up to its workspace root.

Sibling projects and other workspace folders stay separate. Your project doesn't need to install the dotenv package.

Each key appears once in completion, with its source filenames.

Hover and completion details show the values with their filenames, nearest directories first. The extension doesn't guess which environment your application runs.

Unsaved dotenv edits appear immediately in completion and secret peeking.

Associate them with the dotenv language in your project's .vscode/settings.json:

{
  "files.associations": {
    ".dev.vars": "dotenv",
    "**/.env.d/*": "dotenv"
  }
}

This enables syntax highlighting, cloaking, and the toggle in the native editor, and includes those files in completion and secret-peeking discovery.

Open files with Dotenv selected as their language are included too.

Cloaking is visual: copied text contains the actual value.

The Dotenv Editor supports line numbers, multiple cursors, find/replace, folding, comments, and normal editing. Save, undo, and redo use the usual shortcuts and update the underlying document.

If another edit conflicts with yours, your draft stays available to copy instead of overwriting the other edit.

With auto-cloaking enabled, values are masked before the editor becomes visible, and masking updates locally as you type. Each view starts masked and hides values again on tab switches.

The minimap and general hover previews are disabled; encrypted values have their own explicit Decrypt value action.

Fonts and basic editor settings follow VS Code. It uses Monaco, the editor component behind VS Code.

dotenv.cloakColor and dotenv.cloakIcon customize the mask in both the Dotenv Editor and the native text editor. Changes apply immediately. Folder settings are respected in multi-root workspaces.

Custom theme token rules, arbitrary user keybindings, and other extensions don't automatically carry into the embedded editor.

Choose Reopen Editor With → Text Editor.

Cloaking there uses temporary decorations, so values can briefly flash during file opens or tab switches.

The toggle is remembered in extension storage, and dotenv.enableAutocloaking controls cloaking in that view.

Cloaking no longer writes syntax-color settings.

On upgrade, the extension removes only the exact invisible TextMate rules inserted by older versions from editor.tokenColorCustomizations. Your other custom rules stay intact.

In the normal YAML editor, values under env_variables, environment, and env are masked. The same Dotenv: Enable Autocloaking checkbox controls both .env and YAML files and is enabled by default.

This includes Docker Compose maps and lists and Kubernetes name/value entries. Quotes and comments stay visible.

Values can briefly flash on file opens or tab switches. Invalid YAML is handled on a best-effort basis. YAML isn't a source for completion or secret peeking.