Input masking
Input masking replaces or hides the values a visitor types into form fields so those values do not appear as plaintext in a recording. Replayly masks input values by default, from the first snippet, rather than treating masking as an optional evening project after you already collected data.
Why it matters
Without masking, a session replay can easily contain passwords, addresses, or payment-adjacent fields that nobody on the review team should see. Defaults matter because new projects and new teammates will not always remember a hidden setting.
Masking is necessary but not sufficient. You may still need consent, Do Not Track, text masking, or blocked selectors for on-screen content that is not an input. You are also still responsible for your own policy and legal basis.
The privacy controls feature page and the privacy documentation describe how to verify masking and how to tighten it further on paid plans.
Related: Privacy controls. Back to the glossary.