What is input masking?

Input masking is the replacement of the values a user enters into form fields with placeholder characters at record time, so the recording contains the shape of the input but never its content.

Why it matters

Session replay records what a user does, and much of what a user does is type. Passwords, card numbers, addresses and messages all pass through inputs. Recording a customer's password field once is a breach, whatever your retention policy says afterwards.

Masking must happen on the device, before upload: a value that reached your server, even briefly, is a value you now have to protect. Where the line sits above that is a product decision, but credentials and payment details sit below it, where no setting can reach. This is the core of PII handling in replay.

How AnyReplay handles it

The AnyReplay web SDK masks the value of every form field by default. maskAllInputs: false records what visitors type; maskAllTyping: true masks form fields and the text of every contenteditable editor, which is otherwise recorded. Only a real boolean counts. Underneath both sits a floor no option can switch off: passwords, one-time codes, payment card fields, IBANs, routing numbers, sort codes, any 13 to 19 digit value that passes the Luhn check, and a half-typed card number past its sixth digit. email and tel inputs are not on it; they follow maskAllInputs like any other field. Masked values become asterisks in the browser and the characters never leave the page. Masking is independent of consent. Two class hooks work per element: ar-mask masks an element's text and a field's value, ar-block drops the element entirely. React Native works the same way, with secureTextEntry fields always masked on the device. See how to mask sensitive data and the privacy feature page.