You're right.
Environment variables were displayed when the job is running and password variables were not masked.
All env vars are hidden for now when the job is running.
It should fix your issue.
Then, displayed values are encrypted. The hash value displayed is an encrypted value.

Gregory, thank you very much for your quick help.
Looking forward to try it when the new version of the plugin will be released.

It is already released.
Please upgrade to 1.52
http://maven.jenkins-ci.org:8081/content/repositories/releases/org/jenkins-ci/plugins/envinject/1.52/

Running EnvInject 1.62 and Jenkins 1.473 and I'm still having an issue trying to get this to work. It seems that when using a parametrized build, the "password" type field is not being masked. If I use the masked password plugin the console output is correctly masked, but the unencrypted password ALWAYS shows on the Injected environment variables screen.

@Walter
It seems you are using the maskpasswork plugin via a parameterized type.
This plugin is not compatible with EnvInject plugin.
Mak-password capabilities within EnvInject should be sufficient for your need.
You have to use Build Environment > Inject passwords to the build as environment variables

I just want to clarify, I thought that a password parameter is from an Out-of-the-box Jenkins installation. I don't have the mask passwords plugin enabled.

If you don't use the maskpassword plugin, your comment is inappropriate in this issue.
Please make a new issue?
Thanks

This issue with the mask-password plugin is fixed.

Agreed, sorry for the confusion, I will give 1.65 a try.

Version 1.65 is working as I would expect it. Thank-You!