Masking Sensitive Inputs
Session recordings capture the live DOM, which can include values typed into form fields. To keep sensitive data out of recordings, Autopilot masks the values of certain input fields before they are encoded and uploaded. Masking happens on the recording side — the original value never leaves the page.
What gets masked
An element's value is masked when either of the following is true:
- It is a password input —
<input type="password">(the type check is case-insensitive). - It carries one of the Autopilot mask attributes:
autopilot-maskdata-autopilot-mask
Both attribute names are equivalent. Use data-autopilot-mask if you prefer a standards-compliant data-* attribute; use autopilot-mask for brevity. The attribute's value is irrelevant — its mere presence enables masking.
<!-- Masked automatically: password inputs -->
<input type="password" name="password" />
<!-- Masked because of the attribute (either form works) -->
<input type="text" name="ssn" data-autopilot-mask />
<input type="text" name="card" autopilot-mask="true" />
How a value is masked
The element's value attribute is replaced with a run of asterisks (*) of the same length as the original value. The length is preserved; the contents are not.
| Original value | Recorded value |
|---|---|
secret | ****** |
4111 1111 | ********* |
| `` (empty) | `` (empty) |
Only the value attribute is masked — other attributes on the element are recorded as-is.
When masking is applied
Masking is enforced everywhere an attribute value enters the recording stream, so a masked field stays masked for the entire session:
- Initial DOM snapshot — when Autopilot walks the document at startup and records each element's attributes.
- Attribute mutations — when an attribute changes after the snapshot (for example, as the user types and the field's reflected value updates), the new value is masked before it is recorded.
Practical guidance
Password inputs are masked automatically, but other sensitive fields — email, phone, payment details, government IDs, free-text fields that may contain personal data — are not. Add data-autopilot-mask (or autopilot-mask) to any such field so its value is masked in recordings.
Masking only protects fields that are recognized as sensitive at record time. Audit your forms and add the mask attribute to every sensitive field before Autopilot recording is enabled for real users. Once a value is recorded unmasked, it has already left the page.
The masked value keeps the original length (so layout-sensitive replays still look right) but reveals nothing about the actual characters. If even the length is sensitive in your case, avoid placing such data in a recorded input value.