11

I've enabled Platform Encryption on standard Account and Contact fields, as well as on custom fields. In general masked field values are displayed as 5 asterisks (*****), but there are some exceptions: Contact Last Name, for instance, is displayed as 12 asterisks (************)

Is there a rationale / pattern that's being used by Salesforce to determine how many asterisks to display for a given Platform Encrypted field?

It does not appear to be based on the length of the data actually in the field (which is more secure, and a difference from Classic Encryption) --- for instance, I've created Accounts with 80-character names and 2-character names and they always show up as 5 asterisks when masked.

But Contact Last Name is always encrypted as 12 asterisks --- why is this field special? Why not 5?

Account Name field 5 asterisks Contact Last Name field 12 asterisks

3
  • Hi Zach... Did you find any answer about this. Thanks
    – sf_user
    Apr 19, 2016 at 4:23
  • Nope, never got an answer.
    – zachelrath
    Apr 19, 2016 at 13:55
  • I have found interesting information in the docs, but they rather focus on differences between ***** and !!!!! masks
    – Patlatus
    Feb 1, 2018 at 16:18

1 Answer 1

2

I guess this question is not relevant anymore, because since Spring ‘17 View Encrypted Data permission not needed with Shield Platform Encryption and now fields encrypted by Platform encryption, are not masked at all.

However, there are several cases when masks do still apply.

Masks You’ll See

Shield Platform Encryption uses a variety of masks. Some of these simply hide data from view, while others give you additional information about the hidden data.

Note: Masking doesn’t apply to data in custom Lightning components.

Mask ***** for Email, Phone, Text, Text Area, Text Area (Long), URL field types means that

This field is encrypted, and you don’t have permission to view encrypted data.

Mask !!!!! for Email, Phone, Text, Text Area, Text Area (Long), URL field types means that

This field is encrypted, and the encryption key has been destroyed.

Mask ????? for Email, Phone, Text, Text Area, Text Area (Long), URL field types means that

This service is unavailable right now. For help accessing this service, contact Salesforce.

Mask 07/07/1777 for Custom Date field means

This field is encrypted, and you don’t have permission to view encrypted data.

Mask 08/08/1888 for Custom Date field means

This field is encrypted, and the encryption key has been destroyed.

Mask 01/01/1777 for Custom Date field means

This service is unavailable right now. For help accessing this service, contact Salesforce.

Mask 07/07/1777 12:00 PM for Custom Date/Time field means

This field is encrypted, and you don’t have permission to view encrypted data.

Mask 08/08/1888 12:00 PM for Custom Date/Time field means

This field is encrypted, and the encryption key has been destroyed.

Mask 01/01/1777 12:00 PM for Custom Date/Time field means

This service is unavailable right now. For help accessing this service, contact Salesforce.

Note: You can’t put masking characters into an encrypted field. For example, if a Phone field is encrypted and you enter a phone number as *****, or a Date field is encrypted and you enter 07/07/1777, that data is not saved.


The document I have referred above is also outdated.

The up-to-date documentation is located here.

Mask !!!!! for Email, Phone, Text, Text Area, Text Area (Long), URL field types means that

This field is encrypted, and the encryption key has been destroyed.

Mask ????? for Email, Phone, Text, Text Area, Text Area (Long), URL field types means that

This service is unavailable right now. For help accessing this service, contact Salesforce.

Mask 08/08/1888 for Custom Date field means

This field is encrypted, and the encryption key has been destroyed.

Mask 01/01/1777 for Custom Date field means

This service is unavailable right now. For help accessing this service, contact Salesforce.

Mask 08/08/1888 12:00 PM for Custom Date/Time field means

This field is encrypted, and the encryption key has been destroyed.

Mask 01/01/1777 12:00 PM for Custom Date/Time field means

This service is unavailable right now. For help accessing this service, contact Salesforce.

Basically this means that they have just removed masks like ***** and `07/07/1777'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .