Masking Types

A masking type is the specific behavior ALTR applies to a column’s value when a rule in Data Masking matches the querying role — for example, returning the value in full, masking part of it, or returning a fixed placeholder.

The 10 Masking Types

ALTR provides 10 masking types. Which types you can assign depends on the data source and, on Snowflake, the protection type chosen when the tag or column is connected.

Masking Type	Behavior
No Mask	Returns the original value unchanged.
E-Mail	Masks everything before the @ symbol with *; the domain remains visible.
E-Mail Hash	Same as E-Mail, but the masked portion is a SHA-256 hash instead of * characters.
Show Last 4	Masks all but the last 4 characters of the value with *.
Show Last Four Hash	Same as Show Last 4, but the masked portion is a SHA-256 hash instead of * characters.
Full Mask	Replaces the entire value with * characters.
Full Mask Hash	Replaces the entire value with a SHA-256 hash of the original value.
Constant Mask	Replaces the value with a single fixed placeholder based on data type (* for strings, 1 for numbers, a fixed date-time value for date/time columns).
Constant Date	Replaces the value with a fixed date (12/31/9999), regardless of the original data type.
Null	Replaces the value with Null.

Masking Type Priority

When more than one policy applies to the same column, ALTR applies the most permissive masking type among all the rules that match the roles evaluated for the query. Masking types rank from most permissive to most restrictive in this order:

1. No Mask
2. E-Mail Hash
3. E-Mail
4. Show Last Four Hash
5. Show Last 4
6. Full Mask Hash
7. Full Mask
8. Constant Date
9. Constant Mask
10. Null

No Mask returns the original value and is the most permissive outcome; Null is the most restrictive.

Masking Type Availability

On Snowflake, the masking types available depend on the protection type chosen when you connect the tag or column to ALTR. Both tag and column connections can choose a protection type; pushdown (native masking) is the one protection type available only to tag connections. Default masking (external function) supports 5 types: No Mask, Full Mask, E-Mail, Show Last 4, and Constant Mask. Pushdown (native masking) supports all 10 types. Because pushdown isn’t available to columns, column-based masking is always evaluated through default masking, offering the same 5 types. Tokenization and Format-Preserving Encryption are separate Advanced Data Protection mechanisms, not masking types — a tag connected through either protection type replaces or encrypts the stored value instead of returning one of the 10 masking types above. See Advanced Data Protection for those mechanisms.

On Databricks, masking runs as native masking and supports: No Mask, Full Mask, E-Mail, Show Last 4, and Constant Mask. Databricks returns NULL automatically when the querying role isn’t covered by any rule in the policy — this isn’t a selectable masking type.

For masking behavior beyond these built-in types, see custom data masking and masking extensibility on Snowflake.