Data masking replaces sensitive data with fictitious values. The real data stays in the production system. The masked version goes to test environments, training, or third-party vendors. A customer's actual Social Security number becomes a fake one that passes the same validation rules. The format is preserved. The value is not real. Developers can test with realistic data without exposing anyone's personal information.

Masking comes in two forms. Static masking creates a copy of the database with substituted values. Dynamic masking leaves the production data intact and masks it on the fly when unauthorized users query it. Static masking is simpler and safer for test environments. Dynamic masking is useful for production systems where some users need real data and others do not. The techniques vary. Substitution replaces values with realistic fakes. Shuffling rearranges values within a column. Nulling out removes the value entirely. Encryption transforms the data reversibly with a key. Tokenization replaces the value with a token that maps back to the original in a secure vault. Each has trade-offs between realism, reversibility, and security. The goal is to preserve the data's utility for its purpose while removing the risk of exposure. Masked data should look real enough to test with but not be real.

Masking techniques

• Substitution — replace with realistic fake values
• Shuffling — rearrange values within a column
• Nulling out — remove the value entirely
• Tokenization — replace with a token mapped to the original
• Encryption — reversible transformation with a key

Data masking lets organizations use realistic data without carrying the risk. The fake data does the job. The real data stays protected.