I have enabled shield platform encryption in dev org. I have encrypted some of the standard fields like Account Name on Account Object and Email on Contact Object. The System Administrator does not have "View Encrypted Data" permission, but still I am able to see the actual values of those fields instead of getting masked values. How can I get masked values instead of original values.

2 Answers 2


From the Spring 17 release notes -

Turn Off Masking for Encrypted Data

Data masking is being decoupled from Shield Platform Encryption. The “View Encrypted Data” permission and its resulting masking behavior will no longer be available in Shield Platform Encryption when you activate this critical update.

Field-level and object-level security features control who has access to data, regardless of whether it is encrypted.

With this change:

• You get a more consistent experience for users when they access encrypted data

• You reduce confusion between data that’s masked and data that’s encrypted. They aren’t the same thing.

The “View Encrypted Data” permission still applies to Classic Encryption.

  • 1
    If Data masking is decoupled from Shield Platform Encryption then what is the use of “View Encrypted Data” permission?
    – vishnu
    Commented Mar 28, 2017 at 6:26
  • I think that's the question Salesforce asked themselves - again, from the release notes "This means that the “View Encrypted Data” permission, and its resulting masking behavior, will no longer be available", but still note the sentence above - The “View Encrypted Data” permission still applies to Classic Encryption
    – Rob Cowell
    Commented Mar 28, 2017 at 7:49

Salesforce confirmed that “Platform Encryption is Disabled for fields for Masking the data” from Summer 17. Instead they are recommending to do the FIELD LEVEL SECURITY in such case to hide the values who shouldn’t see the values. But still Platform encryption is important in security aspect for below reasons.

  1. Data is Encrypted at Rest - For any compliance or certification that requires all data be encrypted at rest Platform Encryption is the solution as all data will be encrypted on the servers.

  2. In the event that Salesforce is ever breached Platform Encryption will be the only way to ensure any of your customers data that is stolen will be encrypted and unreadable. By default customer data is not stored as encrypted on the servers and only encrypted during transmission.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .