Masking and privacy

All masking happens in the visitor's browser. The original text never leaves the page, so it never reaches your server either.

What is masked by default

  • Every text input.
  • Email addresses anywhere in the page text.
  • Runs of 12 to 19 digits, which covers card and most account numbers.
  • Password fields always show eight dots, so even their length is hidden.

Masking replaces each character with * and keeps word lengths, so the layout in the replay matches the real page.

Marking elements

Add these attributes to your HTML:

Attribute Effect
data-ro-mask Mask all text in this element, including title, alt and placeholder
data-ro-block Do not record this element at all. The replay shows a hatched box of the same size.
data-ro-unmask Record the real value of this input, or of the inputs inside this element 
<section data-ro-mask>Account balance: $12,480.22</section>
<div data-ro-block><canvas id="signature"></canvas></div>
<input name="search" data-ro-unmask>

data-ro-unmask is ignored on password fields, fields with autocomplete="cc-...", and fields named like password, CVV or IBAN. Those are always masked.

Masking more

Turn on maskAllText to mask every piece of text on the page, or maskDigits to mask all numbers. Both make replays harder to follow, so they are off by default. See recorder options.

If your site needs consent before recording, leave out data-endpoint and call ReplayOwl.start(...) once the visitor agrees. Recordings stay on infrastructure you control, which simplifies your data processing agreements, but whether you need consent depends on your jurisdiction and how you use the recordings. See session replay and GDPR for a checklist.

More on what is stored and who can see it: Security and privacy.