> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Data Masking

**Data Masking** hides sensitive values in the result sets returned when users
connect to database assets. A rule selects the columns to mask and the masking
method, so users can run queries without seeing full values such as passwords,
secrets, or personal identifiers.

Open the page from **Console > ACLs > Data Masking**.

![Figure 1: Create data masking rule with column pattern, masking method, and mask pattern.](/images/v5/jumpserver/v5_admin_acls_07.png)

## Overview

A masking rule combines a scope (users, assets, and accounts) with a field
pattern and a masking method. It applies only to database connections; other asset
types are not affected. The rules are scoped to the current organization and are
matched by priority, where a lower number is evaluated earlier.

## Before you begin

- Sign in with an account that can manage ACLs.
- Have at least one database asset and its accounts in the current organization.
- Know which column names should be masked. Check the actual schema first, since
  the rule matches column names, not column positions.

## Create a data masking rule


1

Click **Create**.

2

In the **Create data masking** drawer, fill in the fields below.

3

Click **Submit**.

### Field reference

| Group    | Field          | Description                                                                                                 |
| -------- | -------------- | ----------------------------------------------------------------------------------------------------------- |
| Basic    | Name           | Required. Rule name, unique within the organization.                                                        |
| Basic    | Priority       | Integer from 1 to 100. Defaults to 50; the lower the value, the earlier the rule is matched.                |
| Users    | Users          | **All users**, **Specified users**, or **Attribute filter**.                                                |
| Assets   | Assets         | **All assets**, **Specified assets**, or **Attribute filter**.                                              |
| Accounts | Accounts       | **All accounts** or **Specified accounts**.                                                                 |
| Rules    | Fields pattern | Column names to mask. Supports comma-separated names and the `*` wildcard. Defaults to `password`.          |
| Rules    | Masking method | **Fixed Character Replacement**, **Hide Middle Characters**, **Keep Prefix Only**, or **Keep Suffix Only**. |
| Rules    | Mask pattern   | Replacement text used by **Fixed Character Replacement**, for example `######`.                             |
| Other    | Active         | When selected, the rule takes effect.                                                                       |
| Other    | Comment        | Optional.                                                                                                   |

### Fields pattern examples

| Pattern           | Columns masked                             |
| ----------------- | ------------------------------------------ |
| `password`        | Only the column named `password`.          |
| `password,secret` | The `password` and `secret` columns.       |
| `password*`       | Columns whose names start with `password`. |
| `.*password`      | Columns whose names end with `password`.   |


Note

Masking changes only the result that the user sees. The data stored in the
database is not modified, and applications that connect outside JumpServer are
not affected. Combine this rule with
[Authorizations](https://www.jumpserver.com/docs/features/console/policies/authorizations.md) that limit which accounts and
protocols can reach the database.

## Related topics

- [ACLs](https://www.jumpserver.com/docs/features/console/policies/acls/index.md)
- [Command Filter](https://www.jumpserver.com/docs/features/console/policies/acls/command-filter.md)
- [Accounts](https://www.jumpserver.com/docs/features/console/accounts/index.md)
- [Assets](https://www.jumpserver.com/docs/features/console/assets/index.md)