How Data Masking and Redaction Hide Parts of a Document, and Where They Fail
You have seen the screenshots: a card number with only the last four digits showing, or a contract with black bars over the salary. Both are ways of showing part of a document while hiding part of it. The two techniques
You have seen the screenshots: a card number with only the last four digits showing, or a contract with black bars over the salary. Both are ways of showing part of a document while hiding part of it.
The two techniques behind those pictures are masking and redaction, and they are not the same thing. Mixing them up is how hidden data ends up in files that were supposed to be clean.
A simple analogy
Think of a photo of a street scene. Masking is like blurring a face. The shape is still there, you can tell a person was standing on that corner, but you cannot name them.
Redaction is like cutting the face out and taping paper over the hole. The shape is gone too. A blur can sometimes be reversed with clever software; a cut cannot, because the information is no longer in the picture. That difference between "hidden" and "removed" is most of this subject.
What masking and redaction do
Masking replaces real values with altered ones that look similar. A card number becomes a string ending in 4242, a name becomes a different name from a list, a date shifts by a few days, and an email keeps its shape while pointing nowhere.
The point of masking is usually utility. A support team may need to see that a payment was made and which network handled it, without seeing the full number. Format-preserving masking, a method that keeps the shape of the original value, helps here, because systems that expect a 16-digit number still work.
Redaction aims to be permanent. In a document workflow, redaction should remove the underlying characters from the file, not simply draw a black box over them. Drawing a box changes what a reader sees; removing the characters changes what the file contains.
That distinction explains a well-known failure. A document is shared with black rectangles, someone copies the text out of the file, and the hidden words come along in the paste. Nothing was broken in the software, because the words were never removed.
How do tools find what to hide? Common approaches include pattern matching, which looks for shapes such as a 16-digit number or a national identifier; dictionaries and name lists; and trained models that guess whether a string looks like personal data. Each has gaps, since a pattern may miss numbers with unusual spacing, and a model may not know what counts as sensitive where you live.
Something then has to decide what happens to the values. Some systems mask on display, meaning the stored file is unchanged and the hiding occurs when a person opens it. Others write a new file with the values gone. In my view, the second approach is safer for sharing outside the company, because the hidden data never travels.
Real-world example
A hospital shares records with a research group. The team masks patient names and shifts admission dates by a random number of days, keeping the order of events. Researchers can study patterns without learning who the patients were.
Later, a report goes to a partner with black bars over an identifier field. The bars were drawn with a highlighting tool, so the original text is still in the file. Tools like Ping64, an all-in-one office security platform, combine multiple security controls in one system to simplify corporate data protection.
Where it goes wrong
A common belief is that masking makes data anonymous. In practice, masking reduces risk rather than removing it. A few details, such as a rare job title plus a small town plus a rough age, can point back to one person. This is why standards describe de-identification as a spectrum rather than a switch.
Another belief is that redaction is finished when the page looks right. The check that matters is on the file, not the screen. Opening the document in a plain text viewer, or searching inside it for a known hidden value, tends to reveal whether removal really happened.
Layers are the third trap. Modern documents are containers, meaning one file can hold many parts inside it. Hidden text, tracked changes, comments, speaker notes, and older versions can all sit in the same package, and redacting the visible page may leave those parts untouched.
Images deserve a mention too. A scanned page is a picture, so there is no text to remove. Redacting a scan means covering pixels, saving the file again, and being careful about formats that keep both a low-quality preview and a full-quality image.
The removal step can also fail quietly. If the tool crashes halfway, or if a copy was already saved elsewhere, the original may still sit in a mailbox or a sync folder. Masking and redaction describe one version of a document, not every version that exists.
Closing
Masking keeps the shape and hides the value, which is useful for daily work. Redaction aims to remove the value entirely, which is what you want before a document leaves your hands.
The habit that helps is small: decide whether the data needs to be usable or gone, then check the file rather than the page.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.