Troubleshooting: Masking Questions

Masking is applied in the page before data is sent, so every answer below comes down to what the recorder saw at the moment it serialised the page. The rules are in masking and blocking.

Personal data is visible in a replay

• Masking was turned off. Form fields are masked by default; maskAllInputs: false in your snippet records what visitors type. Remove that line to mask every field again, or keep it and mark the sensitive ones with ar-mask.
• Text that is not in an input — names, emails, addresses rendered as ordinary text — is recorded unless it is inside an element with ar-mask or ar-block. Input masking does not cover it.
• It was typed into a rich-text editor. A contenteditable element holds page text, not an input value, so maskAllInputs does not reach it. Set maskAllTyping: true to mask every editable region as well; see masking and blocking.
• The option was a string. maskAllTyping: "true" — what a tag manager variable often hands over — is not true, so it is ignored and editors are not masked. The console says so; the value must be a real boolean.
• The class was added after the text appeared. Put ar-mask in the markup that renders the text, not in code that runs later.
• You changed `maskClass` or `blockClass`. The custom names replace the defaults; ar-mask no longer applies.
• It is inside an iframe, a canvas or an image. Canvas contents are not recorded; images are recorded by URL. Use ar-block on the container to keep the picture out.
• It is in a custom event or a screen name. Properties passed to track and names passed to screen() are stored as sent. Do not put personal data in them.

A field I need to see shows asterisks

Form fields are masked by default. Set maskAllInputs: false to see what visitors type (and check that maskAllTyping: true is not set, which masks every field whatever maskAllInputs says, and that the value is a real false, not the string "false"). If it still shows asterisks, the field is one of those that are masked in every configuration: a password, a one-time code, a payment field, a field inside an element carrying ar-mask, a value of 13–19 digits that passes the card-number check, or a number that could still become one — digits starting 2–6, more than six of them, grouped like a card. Email and telephone inputs are not on that list — they are ordinary fields, so asterisks there mean field masking is still on. The last two catch an order number now and then — any run of seven or more digits starting 2–6; rename the field or accept the asterisks, because there is no option that turns the floor off. The length and timing of typing are still visible when a value is masked.

The layout looks wrong around a blocked element

ar-block records a placeholder with the element's size at the time it was recorded. If the element changes size later, the placeholder may not follow it. Use ar-mask instead where layout fidelity matters and the text is the only sensitive part.

React Native

• What a person types into a TextInput is masked by default, as in the browser SDK. maskAllInputs: false records it; maskAllTyping: true masks every field and cannot be weakened.
• secureTextEntry fields are always masked, on both iOS and Android, and so is any field whose textContentType, autoComplete, keyboardType, accessibility label, placeholder or testID names a password, a one-time code or a payment instrument — plus any value shaped like a card number, or like one being typed.
• A bare <TextInput /> with no props tells us nothing about itself, so with maskAllInputs: false it is recorded. Give a sensitive one a textContentType, an autoComplete or a testID containing ar-mask.
• To mask a Text, a View or anything else, give it a testID containing ar-mask. Everything inside a masked element is masked too.
• Images are recorded by URL; bundled app images are uploaded once per project. Set maskImages: true if pictures could be personal, such as avatars people upload.
• Photos from the device's caches or photo library are never read.

Are masked values translated?

No. They are asterisks before they leave the device, so there is nothing to translate. See session translation.

How do I prove what is sent?

1. Type a unique value

   Enter something you can search for, such as mask-test-4821, into a form on your site.

2. Inspect the request

   In the network panel, open the POST /v1/ingest/events requests made after typing and search their payloads for the value.

3. Confirm

   A masked field carries asterisks of the same length and no occurrence of the value; an unmasked one carries exactly what you typed. Try it with a password field too: that one is asterisks whatever your options say.