camouflage.nvim

Hide sensitive values in configuration files during screen sharing.

A Neovim plugin that visually masks secrets in .env, .json, .yaml, .toml, .properties, .netrc, .xml, .http, Terraform/HCL (.tf, .tfvars, .hcl), and Dockerfile files using extmarks - without modifying the actual file content.

Demo

Features

• Multi-format support: .env, .json, .yaml, .yml, .toml, .properties, .ini, .conf, .sh, .netrc, .xml, .http, .tf, .tfvars, .hcl, Dockerfile, Containerfile
• Nested key support: Handles database.connection.password in JSON/YAML/XML
• All value types: Masks strings, numbers, and booleans
• Multiple styles: stars, dotted, text, scramble
• Reveal & Yank: Temporarily reveal or copy masked values
• Follow Cursor Mode: Auto-reveal current line as you navigate
• Have I Been Pwned: Check passwords against breach database (Neovim 0.10+)
• JWT Expiry Hints: Decode exp claim and show "expires in 2h" badges
• Hot Reload: Config changes apply immediately
• Event System: Hooks for extending functionality
• TreeSitter Support: Enhanced parsing for JSON/YAML/TOML/XML/HTTP/HCL/Dockerfile
• Telescope/Snacks Integration: Mask values in preview buffers
• Zero file modification: All masking is purely visual
• Extensible: Register custom parsers for unsupported formats via a public API

Security Model

camouflage hides sensitive values visually, by drawing over them with virtual text. It does not change the file, and it does not encrypt or remove anything.

It protects against casual exposure of secrets on screen: shoulder-surfing, screen sharing, pair programming, screenshots, and demos.

It does not protect against anything that reads the buffer or file contents directly, because the real text is still there underneath the mask:

• search results and grep tools, including Telescope live_grep result lines (only the preview buffer is masked, not the matched result rows)
• LSP servers, completion sources, and AI assistants
• :%print, :substitute previews, :w/:saveas, and yanking with yy/"+y
• the +/* clipboard registers (use :CamouflageYank, which copies the real value deliberately with a confirm prompt and timed auto-clear)

For per-repo .camouflage.yaml files, masking config is applied as data only (no code execution). If you don't trust the repositories you open, set project_config.secure = true to gate the file behind Neovim's vim.secure/:trust mechanism.

The scramble style is cosmetic, not protective: the mask is a shuffle of the real characters, so it leaks the value's length and character set.

Installation

lazy.nvim

{
  'zeybek/camouflage.nvim',
  event = 'VeryLazy',
  opts = {},
  keys = {
    { '<leader>ct', '<cmd>CamouflageToggle<cr>', desc = 'Toggle Camouflage' },
    { '<leader>cr', '<cmd>CamouflageReveal<cr>', desc = 'Reveal Line' },
    { '<leader>cy', '<cmd>CamouflageYank<cr>', desc = 'Yank Value' },
    { '<leader>cf', '<cmd>CamouflageFollowCursor<cr>', desc = 'Follow Cursor' },
  },
}

use {
  'zeybek/camouflage.nvim',
  config = function()
    require('camouflage').setup()
  end
}

Plug 'zeybek/camouflage.nvim'

" In your init.lua or after/plugin/camouflage.lua:
lua require('camouflage').setup()

local add = MiniDeps.add
add({
  source = 'zeybek/camouflage.nvim',
})
require('camouflage').setup()

git clone https://github.com/zeybek/camouflage.nvim.git \
  ~/.local/share/nvim/site/pack/plugins/start/camouflage.nvim

require('camouflage').setup()

Configuration

The plugin works with zero configuration. Here's a quick overview of common options:

require('camouflage').setup({
  enabled = true,
  auto_enable = true,
  style = 'stars',           -- 'text' | 'dotted' | 'stars' | 'scramble'
  mask_char = '*',
  debounce_ms = 150,
  max_lines = 5000,

  reveal = {
    follow_cursor = false,   -- Auto-reveal current line
  },

  yank = {
    confirm = true,          -- Require confirmation before copying
    auto_clear_seconds = 30, -- Auto-clear clipboard
  },

  integrations = {
    telescope = true,
    cmp = { disable_in_masked = true },
  },
})

Full configuration reference on the wiki.

Commands

Full commands list on the wiki.

Supported File Formats

For unsupported formats, you can define custom patterns.

Documentation

For detailed documentation, visit the Wiki:

• Getting Started — Installation and first steps
• Configuration — Full configuration reference
• Commands & Keymaps — All commands and suggested keybindings
• API Reference — Lua API for programmatic control
• Events & Hooks — Extend functionality with event listeners
• Have I Been Pwned — Password breach checking
• Integrations — Telescope, Snacks.nvim, nvim-cmp, Lualine
• Project Config — Repo-level .camouflage.yaml
• TreeSitter — Custom TreeSitter queries
• Architecture — Internal design and code flow
• Troubleshooting — Common issues and solutions

You can also use :help camouflage within Neovim.

Also Available

• Camouflage for VS Code - The original VS Code extension

License

MIT License - see LICENSE for details.