Hash masking policy (predefined)

Edit online

The predefined Hash policy masks a selected column by applying a cryptographic hash algorithm to the input value, producing a numeric output.

The Hash policy accepts arbitrary string input and produces a numeric hash as output. You can optionally remove specific characters from the input before hashing and control the case of the input before it is passed to the algorithm.

The operations are applied in the following order:

Replace — specified characters are stripped from the input.
Case — the case transformation is applied to the stripped input.
Algorithm — the processed input is hashed.

The output is fully determined by the processed input. SHA and HMAC produce identical outputs when given the same processed input. The algorithm choice affects the internal computation and its security properties, not the output format.

Configuration options

Use the following options to configure the Hash policy.

Algorithm (required)

Table 1. Hash algorithm options
Option	Description
`SHA`	Hashes the input using SHA. Output depends only on the processed input.
`HMAC`	Hashes the input using HMAC with a secret key. Output depends on the processed input and the key. Use HMAC when the input domain is small or predictable (for example, short codes or fixed identifiers), as the secret key prevents brute-force reversal.

Replace (optional)

A string of characters to remove from the input before applying Case and hashing. Every individual character present in this string is stripped, including all occurrences, regardless of position or order.

Important: Replace is case-sensitive. E removes uppercase E only; e removes lowercase e only. To remove both, specify both (for example, eE). Replace also removes individual characters, not substrings. For example, "Test" removes every T, e, s, and t individually from the input.

Case (required)

Controls the case of the input before it is passed to the hash algorithm. Applied after Replace.

Table 2. Case options
Option	Behavior
Normal	Input is passed to the algorithm with its original case.
Upper	All letters are made uppercase before hashing.
Lower	All letters are made lowercase before hashing.

Note: Changing Case produces a different hash output even for identical source values, because the processed input differs.

Examples

All examples use the input TestInput. The Processed Input column shows what is actually passed to the hash algorithm after Replace and Case are applied.

Table 3. Hash policy examples
Input	Algorithm	Replace	Case	Processed input	Output
`TestInput`	`SHA`	—	`normal`	`TestInput`	`2231312`
`TestInput`	`HMAC`	—	`normal`	`TestInput`	`2231312`
`TestInput`	`HMAC`	—	`upper`	`TESTINPUT`	`12163255`
`TestInput`	`HMAC`	—	`lower`	`testinput`	`1829732`
`TestInput`	`SHA`	`e`	`normal`	`TstInput`	`14100055`
`TestInput`	`HMAC`	`Test`	`normal`	`Inpu`	`18304587`

API configuration (policy_metadata)

Use the following keys to configure the Hash policy through the API.

Table 4. Hash policy_metadata fields
Key	UI field	Type	Description
`algo`	Algorithm	String	`"SHA"` (default) `"HMAC"`
`replace`	Replace	String	Characters to strip before hashing. Use `""` for none.
`case`	Case	String	`"normal"` `"upper"` `"lower"`

{
  "algo": "SHA",
  "replace": "",
  "case": "normal"
}

Known limitations

The Email policy has the following limitations.

Replace is case-sensitive: Each character in the Replace string is matched exactly. To remove a letter in both cases, include both forms (for example, eE).
Replace removes individual characters, not substrings: The Replace value is treated as a set of characters. "Test" removes every T, every e, every s, and every t, not just the exact sequence "Test".
Case affects the hash input, not the stored value: The Case setting transforms the input before hashing only. Two rows with the same source value but different Case settings produce different hash outputs.