I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data.

I came across some articles and software that were talking about encrypting this data, and my supervisor seemed interested. I tried to get my head around it for a while but I can only see it as a hassle with no benefit whatsoever: data which needs to be secured is already encrypted and masked data will never be decrypted (if unmasked data is required for some reason, then a request to the responsible DBA will be issued, who then will dump data from the relative production database). From what I understand keys are also discarded.

Am I right or does encrypting has actually some benefit relative to data masking?

  • 3
    They serve two different purposes. Data masking hides information from people who don't need it. Encryption protects information which is needed, but which shouldn't be readily accessible to anyone who can access the server. You can often think of encryption as a type of data masking, albeit one that can be undone by people with the right key, as opposed to "real" data masking which is often irreversible (e.g. replacing a password hash with the exact string *****)
    – anon
    Jul 17, 2019 at 21:09
  • 2
    Thinking aloud... one possible reason to encrypt might be to keep fields distinct. If, say, you were storing SSNs, where you would normally expect each to be unique, masking them with a string of ********* could break many interactions. Encrypting should maintain that they are all different. (And, if the same settings were used for each record, any duplicates should be preserved).
    – TripeHound
    Dec 12, 2019 at 12:02
  • So, encrypting and throwing away keys sounds like hashing, which would be easier to do, I would think.
    – schroeder
    Dec 12, 2019 at 13:23
  • @schroeder A possible downside of hashing would be all fields will be the same length (possibly not very important) but that length may be too long to store in the available space (depending on the how the schema was defined). Having said that, the results of a "binary" encryption might not be easily stored "as is", and doing something like base64-encoding might make them too long as well.
    – TripeHound
    Dec 12, 2019 at 16:13
  • @schroeder suppose you join/deduplication logic depends on PII. Hash function can't be bijective (see stackoverflow.com/questions/39097977/bijective-hash-function) so you will get collision sometimes, that will break your ETL results
    – VB_
    Feb 9, 2021 at 16:39

2 Answers 2


If your developers need to work with the data it doesn't make sense to encrypt them, because they will need that data to test the functionality.

If you would AES256 encrypt an address field

it would become binary data which you could base64 encode or store as is. That data would be unusable for the developer, because it doesn't reveal the context.

Example: Cool street 16 => abcdabcdab==

Masking data is the best solution

Example: Cool street 16 => Abcd street 69

Developers can still work with this data, but it doesn't reveal the sensitive details.

  • 2
    Doesn't that depend on your tests? Shouldn't you design tests that don't require human interpretation of values? abcdabcdab== is easily compared to abcdabcdab== and $DATA is compared to $DATA
    – schroeder
    Dec 12, 2019 at 14:09
  • @schroeder sorry I didn't quite get where are you going with this. If you don't care about data types and formats you don't need production data at all, random values will suffice. Dec 12, 2019 at 18:56
  • You can encrypt data types and formats too
    – schroeder
    Dec 12, 2019 at 18:58
  • Yeah but as a developer you will need to decrypt the data in order to do work with them. Data masking hides data elements that users of certain roles should not see and replaces them with similar-looking fake data, which are typically characters that will meet the requirements of a system designed to test or still work with the masked results. Dec 12, 2019 at 19:00
  • @schroeder I think this is a great read about +/- of data masking vs encryption blogs.informatica.com/2015/10/05/… Dec 12, 2019 at 19:03

yes encryption is not a preffered way to secure a data base because of following reasons: encryption needs to be supported for different flavours of Data bases for consistancy, managing encryption keys because multiple databases can have multiple instances and keys needs to be secured as well, it slows the performance as well that involves time for encrypting and decrypting because bulk of data is involved.

  • The OP said that the keys are discarded, which means that nothing is being decrypted, which means all of your points do not apply.
    – schroeder
    Dec 12, 2019 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .