By default, usernames are not masked in the build log. You may choose to mask a credential's username if you consider it to be sensitive information. However, this can interfere with diagnostics. For example, if the username is a common word it will cause unrelated occurrences of that word to also be masked.
Regardless of this setting, the username will be displayed in the selection dropdown to anyone permitted to reconfigure the credentials.