I was trying to understand the difference between encryption and masking

Below statement says that real data replaced and gone!

Masking protects your data by transforming it into a readable format that’s useless to anyone who steals it. The actual data is replaced by fictional information. There is no encryption solution to revert the data to its original state. The real data was replaced and is gone forever.

What does it mean? If real data are gone, then how do I use it in my system?

For example:

I might masked EMAILID and my system wants to do some logic based on the email ID, then how do I compare the email ID in code?

Basically, if I am not using the sensitive data, why do I store it in my database in the first place?

2 Answers 2


Data masking occurs just before the data is sent to the client (your program, SSMS, etc). In that sense, it is "replaced and gone" by the time it gets to a client that is requesting the data to view it (assuming the user accessing the data doesn't have the UNMASK privilege). Thus, you can perform logic on it in your queries (apply where clauses to it, update it, etc). But you won't see the real data if you include it in a SELECT statement.

However, the data is still stored on the server unencrypted. And in fact, you can use this knowledge to figure out exactly what data is in the table - even if you don't have the UNMASK privilege. See Joe Obbish's great post on that topic here: Dynamic Data Unmasking

The difference between that and something like "Always Encrypted" is that only the encrypted version of the data is stored, and a key must be used to decrypt and use / view the data.


Id addition to Josh's reply:

In some cases, it makes sense to store the data as masked. This is in contrast to using the "Dynamic Data Masking" functionality in SQL Server (as described by Josh).

For instance, you export data from a production database into a development database. Some information shouldn't be available to the developers. So we replace a group of numbers in the credit card number series with asterisks before that data arrives to the development server.

It is of course impossible to get to the "real" data on the dev server, since it was never there in the first place - and that was our very purpose!

  • Ah, that's probably what the OP is referring to! I assumed it was the Dynamic Data Masking feature 😁 Feb 18, 2021 at 15:10
  • 1
    Possibly, hard to say without context. A google search suggests the following web page was used, which is more inline with my example. But as generic terms, I think that functionality such as DDM is also relevant to mention... cloudhesive.com/blog-posts/… Feb 18, 2021 at 15:20
  • 2
    And my upvotes for both of you, as this is something I'm currently loosely exploring to potentially implement in my work environment, so both your posts are helpful. 🙂
    – J.D.
    Feb 18, 2021 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.