Data Masking Tool

Masking, Encryption, and Anonymization Are Not the Same

It's easy to lump these concepts together as just 'hiding data,' but they have different purposes and levels of reversibility. This tool only performs one of them: masking.

Understand What Each Preset Keeps Visible

Each preset has fixed rules about which parts of the string to keep. If you use them without understanding what's left visible, you might end up revealing more information than you intended.

The Phone Number, Card Number, and SSN presets preserve the original hyphens and spaces, replacing only the digits. Whether you input `010-1234-5678` or `01012345678`, the output format will match the input.

Masked Data Can Still Identify People

The real danger of masking lies in the combination of the remaining pieces. Each piece might seem harmless on its own, but when displayed together, they can be enough to identify an individual.

• SSN (RRN) `900101-1******` — Even with the latter half masked, the full date of birth and gender digit remain. Cross-referencing this with an internal employee list could easily reveal the person's name.
• The last 4 digits of a phone number — These are often memorized by the person, their family, and close contacts. Among acquaintances, this type of masking offers little protection.
• Email domain — If `company.co.kr` remains visible, it reveals the person's affiliation. For smaller companies, the first two letters of the username might be enough to narrow it down to one person.
• Name `홍*동` (H*ng) — The first and last characters remain. This follows a common Korean practice of masking only the middle character of a three-character name, so acquaintances can often guess the full name.
• Displaying multiple masked fields together — Combining a masked name, a masked phone number, and a location dramatically increases the risk of re-identification.

Real-World Use Cases

1. Before sharing customer support logs in Slack or a messenger — Copy the email and phone number columns, paste them into the tool using their respective presets, and then paste the results back. If you paste multiple lines, each will be processed individually.
2. When including real order data in an incident report or meeting materials — Masking is ideal here because it preserves the data's format, which is often crucial for context. If you delete it completely, it's impossible to tell if an issue is related to formatting or length.
3. When creating screenshots for documentation or blog posts — Changing the 'Masking Character' to a black circle (●) can look cleaner and more professional than the default asterisk (*).
4. When deciding on a logging format during development — Use the Custom mode to experiment with different numbers of characters to keep at the start and end, allowing you to visually determine the right balance of privacy and utility.

What This Tool Can't Do

• Text within images — This tool can't process personal information in screenshots because it's pixel data, not text. When redacting images, avoid semi-transparent highlights or mosaic filters, as they can sometimes be reversed. Use an opaque, solid-color box instead.
• Text inside PDF or Word documents — You need to edit the text within the file itself. Simply placing a black box over text in a PDF often leaves the underlying text intact and copyable.
• Bulk data in a production database — This is a manual, browser-based tool for visual tasks. For large-scale operations, it's better to handle masking directly in your database using SQL or a dedicated script.
• International or extension numbers — The 'Phone Number' preset is optimized for standard 9- to 11-digit numbers. Other formats are handled by the Custom masking logic, which may not produce the desired result.