PII masking
PII masking is the practice of replacing or obscuring personally identifiable information, such as names, email addresses, card numbers and typed passwords, before data is stored, displayed or shared, so that the record stays usable without exposing the person it describes. In testing and bug reporting it applies to screenshots, session replays, logs and test data that would otherwise carry real user details.
The longer version
Masking works at the point of capture or at the point of display. A replay recorder replaces the characters a user types in a form field with a placeholder before the recording leaves the browser. A logging library redacts fields that match a pattern for card numbers or email addresses before writing the line. A database copy for testing has its name and address columns overwritten with generated values. In each case the shape of the data survives, so a bug that depends on a long name or an address with a comma still reproduces, while the actual value never reaches the people investigating it.
Anonymisation removes the link between a record and a person permanently, so the data cannot be re-identified, and it is the standard for test data copied from production. Masking hides values in place, at capture or at display, and may leave part of a value visible, which is enough for a screenshot or a log line. Encryption protects data at rest and in transit but shows the plain value to anyone authorised to decrypt it, so an encrypted replay of a checkout form still shows the card number to the developer who opens it. The sense here is the testing and evidence one; the same term names a data-engineering discipline for warehouses and pipelines.
The leak is the evidence. A tester screenshots a customer record to show a layout bug and pastes it into a ticket that the whole company can read. A replay records a password field as plain keystrokes. A console log prints the full API response with the user's email in it. Each ends up attached to a report, synced into a tracker and kept for months. Masking that runs before capture is the only version that helps here, because a rule applied at display time does nothing for the copy already pushed to a third-party tracker.
Common questions
What is the difference between PII masking and anonymisation?
Anonymisation permanently removes the link between data and a person so the record cannot be re-identified, and it is the standard for test databases copied from production. Masking hides values in place, often at capture or display time, and may be partial or reversible. Masking protects a screenshot or a log line; anonymisation protects a data set.
What counts as PII in a bug report?
Any value that identifies a person on its own or in combination: names, email addresses, phone numbers, postal addresses, account identifiers, card numbers, and anything typed into a password field. Screenshots of customer records, session replays of forms and console logs that print API responses are the usual carriers in a report.
Does session replay record passwords?
A session replay tool that masks input records that a field was typed into and replaces the characters with placeholders before the recording leaves the browser, so passwords never reach the recording. A tool without input masking captures keystrokes as typed. Checking which one is in use is part of setting up replay on any page with a form.
Who is responsible for PII masking in testing?
Engineering owns the configuration of every capture point: the replay recorder's input masking, the logging library's redaction rules and the anonymisation step that produces test databases. Whoever holds the privacy or compliance role sets what counts as personal data and reviews those rules. Each tester is responsible for the artefacts they create by hand, such as a screenshot pasted into a ticket.
Can PII masking be undone?
Masking applied at the point of capture cannot be undone, because the real value was never stored; a replay that recorded placeholders holds nothing else. Masking applied at display time keeps the original and hides it from the viewer, so anyone with access to the stored record, or to a copy synced into a tracker, can read it. That difference decides whether a leaked artefact is a breach.
Bug reports that arrive ready to triage.
Collect replay, console, network and browser context with the Free plan.