The issue we have with this feature, is that variables which don't have to be masked (not a password/username/Ip address/...) are still masked in the logging of tasks run in octopus.

Maybe a solution would be to add configuration on a per script basis, that makes it possible to turn this feature of for a certain script.

Or maybe provide a command that could be used in scripts to log certain variables without any masking of sensitive data.

Right now, it is not very helpful.

mimicked Ronnie Overby's function in PowerShell

function DecodeSensitive ($EncodedValue, $MasterKey) {
$Cipher = [Convert]::FromBase64String($EncodedValue.Split('|')[0])
$Salt = [Convert]::FromBase64String($EncodedValue.Split('|')[1])
$Key = [Convert]::FromBase64String($MasterKey)

# Create AesCryptoServiceProvider, put key and salt to it, extract decryptor
[System.Security.Cryptography.AesCryptoServiceProvider]$Algorithm = [System.Security.Cryptography.AesCryptoServiceProvider]::new()
$Algorithm.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$Algorithm.KeySize = 128
$Algorithm.Key = $Key
$Algorithm.BlockSize = 128
$Algorithm.Mode = [System.Security.Cryptography.CipherMode]::CBC
$Algorithm.IV = $Salt
$Decryptor = $Algorithm.CreateDecryptor()

# New memory stream, decoded value will be putten in there
$MemoryStream = [IO.MemoryStream]::new()

# Create new CryptoStream from MemoryStream, put encoded value(cipher) and decryptor in there, exctract decrypted value.
$CryptoStream = [Security.Cryptography.CryptoStream]::new($MemoryStream, $Decryptor, 'Write')
$CryptoStream.Write($Cipher, 0, $Cipher.Length);
try {
$CryptoStream.FlushFinalBlock()
}
catch {Write-Error "Can't decode value. Probably the master-key is wrong."}

$DecryptedValue = [System.Text.UTF8Encoding]::UTF8.GetString($MemoryStream.ToArray())

#Clean up the memory
$MemoryStream.Close()
$CryptoStream.Close()
$Decryptor.Dispose()
$Algorithm.Clear()

return $DecryptedValue
}

I also have made script wich can decrypt and replace any variable in octopus.
See examples of usage in the script's body. Please dont forget to make database backup/snapshot before run.

https://github.com/AnSmol/HandyPoshScripts/blob/master/DevOps/OctoVarUnsensitifier.ps1

The method outlined here worked well for me https://www.squirrelistic.com/blog/how_to_display_value_of_sensitive_variable_in_octopus_deploy

I also agree that sensitive values in the UI are kept hidden. However, if you have the master key (or access to the server to retrieve the master key), it's not difficult at all to view your sensitive variable values. Here's a linqpad script that I whipped up:

https://github.com/ronnieoverby/linqpad-utils/blob/master/octopus%20sensitive%20variables.linq

I like that the values are kept hidden. Perhaps offering a "validate" action where the user inputs what they believe the value should be and the Octopus simply returns a "yes, that matches" or "no, it does not match". That should satisfy the requests around wanting to "make sure it's correct" without exposing the value via the UI.