diff --git a/internal/tools/orchestrator/conf/conf.go b/internal/tools/orchestrator/conf/conf.go
index a3398f8dc5f..529925fba4d 100644
--- a/internal/tools/orchestrator/conf/conf.go
+++ b/internal/tools/orchestrator/conf/conf.go
@@ -57,6 +57,7 @@ type Conf struct {
 	TraceLogEnv           string `env:"TRACELOGENV" default:"TERMINUS_DEFINE_TAG"`
 	WsDiceRootDomain      string `env:"WS_DICE_ROOT_DOMAIN" default:"app.terminus.io,erda.cloud"`
 	TerminalSecurity      bool   `env:"TERMINAL_SECURITY" default:"false"`
+	TerminalMasking       bool   `env:"TERMINAL_MASKING" default:"false"`
 	ExecutorClientTimeout int    `env:"EXECUTOR_CLIENT_TIMEOUT" default:"10"`
 	CustomRegCredSecret   string `env:"CUSTOM_REGCRED_SECRET" default:"regcred"`
 	ErdaNamespace         string `env:"DICE_NAMESPACE" default:"default"`
@@ -198,6 +199,10 @@ func TerminalSecurity() bool {
 	return cfg.TerminalSecurity
 }
 
+func TerminalMasking() bool {
+	return cfg.TerminalMasking
+}
+
 func ExecutorClientTimeout() time.Duration {
 	return time.Duration(cfg.ExecutorClientTimeout) * time.Second
 }
diff --git a/internal/tools/orchestrator/scheduler/executor/plugins/k8s/terminal.go b/internal/tools/orchestrator/scheduler/executor/plugins/k8s/terminal.go
index c585d21c718..323a8a0d23f 100644
--- a/internal/tools/orchestrator/scheduler/executor/plugins/k8s/terminal.go
+++ b/internal/tools/orchestrator/scheduler/executor/plugins/k8s/terminal.go
@@ -212,7 +212,7 @@ func (k *Kubernetes) Terminal(namespace, podname, containername string, upperCon
 				return
 			}
 			m[0] = Output
-			if conf.TerminalSecurity() {
+			if conf.TerminalSecurity() || conf.TerminalMasking() {
 				m = hidePassEnv(m)
 			}
 			if err := upperConn.WriteMessage(tp, m); err != nil {