I have vf page with standard controller of custom object and extension. I have created Text(Encryption) field and allow user to enter this field from vf page. I have some validation on submit button but in javascript function if I print Text(Encryption) field value, it displays actual values instead of masking values. Is there any option where we can mask Text(Encryption) field value once entered?

  • Why is it a problem for client-side JavaScript to be able to view a value the user just entered on the same page? I'm not sure I understand the concern. Classic Encryption isn't actually performed until the value hits the server.
    – David Reed
    Oct 23, 2018 at 13:21
  • Thank you David for reply. Is there any way to encode vf page value before hitting to server?. I want to secure that field while traveling from client side to server side. Thanks in Advance. Oct 23, 2018 at 13:52
  • Your form submissions are sent over HTTPS. They're safe in transit. You can't meaningfully secure them from client-side security threats, like keyloggers or JavaScript injection.
    – David Reed
    Oct 23, 2018 at 13:53
  • So there is no way to secure confidential fields on the client side from client-side security threats, like keyloggers or JavaScript injection? Oct 23, 2018 at 14:07

2 Answers 2

I tried below code and it is showing *** in javascript in alert. Try below 
code and add page to your record layout as well.

<apex:page standardController="Position__c" extensions="encryptClass">
 <apex:form >

<script >
  function JSMethod(){
    var fld =  document.getElementById("j_id0:j_id1:j_id3:j_id4:formId").innerHTML;
    alert('fld is '+fld);

<apex:pageBlock >
  <apex:pageBlockSection >
    <apex:outputField value="{!Position__c.Salary__c}" id="formId"/>

  <apex:pageBlockButtons >
    <apex:commandButton onclick="JSMethod()" action="{!save}" value="Save"/>

public class encryptClass {

  public encryptClass(ApexPages.StandardController controller) {


  public void save(){

  • Thank you Jaydeep for response. but instead of "innerHTML" if we use "value" attribute that time it displays entered value which is data breach. :( var fld = document.getElementById("j_id0:j_id1:j_id3:j_id4:formId").value; THIS DISPLAYS EXACT VALUE OF MASKED FIELD. Oct 23, 2018 at 12:49

Classic Encryption is implemented entirely on the Salesforce backend. Values entered in a Visualforce page are not encrypted under Classic Encryption until they reach the server, although the transmission channel to Salesforce is encrypted with HTTPS.

Classic Encryption does not impact client-side JavaScript's access to user-entered values. You can use this page as an example:

<apex:page standardController="Account">
    <apex:form id="form">
        Output Field: <apex:outputField id="output" value="{! Account.Test_Encrypted_Field__c }" /><br />

        Input Field: <apex:inputField id="input" value="{! Account.Test_Encrypted_Field__c }" />

        <button onclick="check(); return false;">Check</button>
        function check() {
            let output = document.getElementById('{! $Component.form.output }');
            let input = document.getElementById('{! $Component.form.input }');

            console.log('Output Value on click: ' + output.value);
            console.log('Input Value on click: ' + input.value);


If you open the page with an Account that has a value populated in the encrypted field Test_Encrypted_Field__c, your JavaScript logs will show undefined as the value of the output field and a mask (****) for the input field. Once you enter data in the input field, however, JavaScript can access the value of the new user input there.

Visualforce does not provide a comprehensive JavaScript security layer like Lightning's LockerService. There is little you can do to mask these values against JavaScript running on the page while they're still simply user input on the client.

Additionally, note that on-Salesforce,

Encrypted field data is not always masked in the debug log.

Classic Encryption is not a panacea for protecting data in every situation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .