Data Masking Software and Tools
Data masking replaces sensitive values with realistic fake ones, so teams can test, analyze, and train AI on real-shaped data without exposing real people. This page covers what data masking is, how it works, the main types and techniques, how to choose data masking software, and how C² does it.
What is data masking?
Data masking is the process of replacing sensitive data, such as names, Social Security numbers, card numbers, and medical record numbers, with realistic but fictitious values that keep the original format, so applications and tests still work.
Data masking is also called data obfuscation or data scrambling. In healthcare it is often one step toward HIPAA de-identification. On this page we say "data masking" throughout.
Field | Real value | Masked value |
|---|---|---|
Name | Maria Lopez | Anna Fischer |
Social Security number | 123-45-6789 (example) | 987-65-4321 (a 900-series number, never issued to a person) |
Card number | 4111 1111 1111 1111 (test card) | 4012 8888 8888 1881 (another test card; passes the Luhn check) |
Date of birth | 1984-03-14 | 1984-05-02 |
Medical record number | MRN 0047729 | MRN 0083154 |
The masked record looks and behaves like a real one. It has the same length, the same format, and valid check digits, but it no longer points to a real person.
Why do teams mask data?
Teams mask data so they can use copies of production data for work that does not need the real values. The most common reasons:
Software testing. Test and QA environments need realistic data, but they are rarely protected like production. See data masking for banking test environments and masking EHR data in test environments.
Analytics. Analysts need patterns, not identities.
AI and machine learning. Training data should not teach a model real names, account numbers, or diagnoses. See data masking for AI training data.
Sharing with vendors and offshore teams. Masked data can leave the production boundary when real data cannot.
Compliance. HIPAA, PCI DSS, GDPR, and state privacy laws all limit where real personal data can go. See HIPAA data masking requirements and PCI DSS data masking.
The cost of getting this wrong is high. The global average cost of a data breach was $4.44 million (IBM Cost of a Data Breach Report 2025).
How does data masking work?
Data masking works in five steps:
Find the sensitive data. You cannot mask a column you do not know about. Discovery scans databases, files, and cloud storage for personal, health, and financial data. See sensitive data discovery.
Choose a rule for each data type. A card number needs a valid card-shaped value; a date of birth needs a plausible date; a free-text note needs names and IDs removed.
Apply the rules to a copy. The masking job reads the production copy and writes masked values, keeping keys and formats intact.
Check the result. Confirm that no real values are left and that applications and tests still run.
Keep an audit trail. Record what was masked, when, with which rule, so you can prove it to an auditor.
The weakest step is usually the first. Masking tools that rely on a list of known column names miss sensitive data stored in columns with unexpected names, in free text, or in new tables.
What are the types of data masking?
There are three main types of data masking, based on when it happens: static, dynamic and on-the-fly. Deterministic masking is a property any of them can have: the same input always gives the same output.
Type | What it is | When to use it |
|---|---|---|
Static data masking | Masks a copy of the database once; the copy stays masked | Test, development, analytics and AI training copies |
Dynamic data masking | Masks values at query time for users who should not see them; the stored data is unchanged | Production apps where some users see partial values |
On-the-fly masking | Masks data as it moves from production to the target, so unmasked data never lands there | Continuous delivery of test data |
Deterministic (a property) | The same input always becomes the same masked value, across tables and runs | Any case where joins and referential integrity matter |
For a deeper comparison, read dynamic vs static data masking.
What are the main data masking techniques?
Data masking techniques are the rules that turn a real value into a fake one. Most masking jobs combine several techniques, one per data type.
Technique | How it works | Good for |
|---|---|---|
Substitution | Replaces a value with a realistic one from a lookup list | Names, addresses, cities |
Shuffling | Moves real values between rows in the same column | Large columns where the overall distribution matters. Not for names or ID numbers, because the real values stay in the data |
Nulling or blanking | Replaces the value with empty or a fixed value | Fields no test needs |
Hashing | Turns the value into a fixed-length string using a keyed hash (a hash with a secret key). A plain hash of a short value, such as an SSN, can be reversed by trying every possible input | Join keys that do not need to look real |
Date shifting | Moves dates by a random but consistent offset | Birth dates and visit dates |
Number variance | Changes numbers within a set range | Salaries, balances, lab values |
Format-preserving encryption | Encrypts the value but keeps its length and format; reversible with the key | Card and account numbers in systems that validate format. See format-preserving encryption |
Tokenization | Swaps the value for a token; the token system, usually a secure vault, can return the real value | Payment data where the real value is needed later |
Data masking vs encryption, tokenization, anonymization and redaction
Data masking replaces a value with a usable fake; encryption and tokenization hide it in a way that can be undone; anonymization removes any reasonable way to identify the person; redaction removes the value with no replacement.
Compared with | Main difference |
|---|---|
Encryption | Encryption is reversible with a key and usually changes the format; masking keeps the format and is usually one-way. Read more: Data masking vs encryption. |
Tokenization | Tokenization can swap the token back for the real value; static masking replaces the value for good. Read more: Tokenization vs masking. |
Anonymization | Anonymization makes re-identification no longer reasonably likely; masked data that can still be linked back is pseudonymized, not anonymous. Read more: Masking vs tokenization vs anonymization. |
Redaction | Redaction removes or blacks out the value; masking replaces it with a usable fake. |
What types of data masking tools are there?
Data masking tools fall into four groups. Each has a place, and each has limits.
Type of tool | Good at | Watch out for |
|---|---|---|
Built into the database | Dynamic masking for one database, no extra software | Only works on that database; little or no discovery; hard to keep rules the same across systems |
Open source scripts and libraries | Free, flexible for one-off jobs | You build and maintain discovery, rules, referential integrity and audit yourself |
Cloud-provider tools | Easy inside one cloud | Usually limited to that cloud; on-premise and other clouds need something else |
Enterprise data masking platforms | Many data sources, consistent rules, audit trail | Price and setup time; check where the data is processed |
How do you choose data masking software?
Choose data masking software on eight points. Ask each vendor the question in the right-hand column and ask them to show it, not just say it.
What to check | Why it matters | Ask the vendor |
|---|---|---|
Discovery accuracy | You cannot mask what you miss | What share of sensitive data did your tool find in a side-by-side test, and how was it tested? |
Referential integrity | Joins and tests break if the same customer gets different masked IDs in different tables | Does the same input mask the same way across tables, databases and runs? |
Format preservation | Applications reject values with the wrong length or check digit | Do masked card numbers pass the Luhn check? Do masked SSNs keep a valid format? |
Data source coverage | Sensitive data sits in many systems | Which databases, file stores and cloud services do you support today? |
Deployment model | Some teams cannot send data outside their walls | Does the tool, including its detection models, run inside our environment? |
Performance | Large copies need to be masked overnight, not over a week | How long does a masking run take on a database our size? |
Audit trail | Auditors ask for proof | Can you show which rule masked which column, and when? |
Certified cryptography | Encryption-based techniques are only as strong as the crypto behind them | Is your cryptography FIPS 140-3 validated, and what is the NIST certificate number? |
How does C² mask data?
C² masks data with two modules of the C² Data Privacy Platform: C² Discover finds the sensitive data, and C² Secure masks, encrypts or redacts it. Findings flow from discovery straight into masking jobs, so there is no hand-built column mapping.
It finds more of the data first. In C² side-by-side tests against 3 other leading data masking tools, C² found 91% of sensitive data; the other tools averaged 59%. C² missed 3%; the others missed 12% to 50%. C² supports 17 data source types; the others averaged 11.
Masked values keep their shape. 34 entity-typed algorithms, including Luhn-valid card numbers, valid-format SSN, SIN and passport numbers, and lexicon-based names and diagnoses.
Joins keep working. The same input masks the same way across runs, tables and databases, so referential integrity holds across your whole estate.
Certified encryption. Format-preserving encryption uses a FIPS 140-3 validated cryptographic module (NIST certificate #4943).
Your data stays with you. C² runs inside your own environment, models included, so sensitive data never leaves your walls.
Use the tools you already have. C² Secure can also work with your existing masking, redaction and synthetic data tools.
Data masking by industry and regulation
Data masking helps meet healthcare and payment rules by keeping real patient and card data out of test, analytics and AI copies.
Healthcare: HIPAA allows de-identified data to be used and shared outside the Privacy Rule's limits. The two methods, both in 45 CFR 164.514(b), are Expert Determination (a qualified expert finds the re-identification risk is very small) and Safe Harbor (remove 18 types of identifiers of the person and their relatives, employers and household members, with no actual knowledge that the rest could identify them). See C² for healthcare, HIPAA data masking requirements and how to mask patient data for testing.
Financial services: PCI DSS v4.0.1 Requirement 6.5.5 says live card numbers (PANs) are not used in pre-production environments unless those environments are included in the cardholder data environment and protected in accordance with all applicable PCI DSS requirements. See C² for financial services and PCI DSS data masking.
Salesforce: sandboxes copied from production carry real customer data. See C² Salesforce test data management.
Frequently asked questions
Is data masking reversible?
Most static masking is not reversible. Substitution, shuffling and nulling replace the original value, so it cannot be recovered from the masked copy. Format-preserving encryption and tokenization are reversible by design, for whoever holds the key or the token system.
Is masked data still personal data under GDPR?
Usually yes. If masked data can still be linked back to a person, for example with a key, a mapping table or other data, it is pseudonymized data, and GDPR still applies (GDPR Article 4(5) and Recital 26). Only data where re-identification is no longer reasonably likely counts as anonymous.
What is the difference between static and dynamic data masking?
Static data masking changes a copy of the data once, for test, analytics or AI use. Dynamic data masking leaves the stored data unchanged and hides values at query time for users who should not see them. More on static vs dynamic.
Does data masking break applications?
Not when the masked values keep the original format and referential integrity. Applications break when a masked card number fails a check digit test, or when the same customer gets different IDs in different tables, so check both before you choose a tool.
See how C² masks your data
Try C² on your own data, or book a demo to talk with our team.