INTERACTIVE / DATA PROTECTION

Data protection lab.

One value, three different outcomes. A reference, a redacted view, and encrypted data.

Educational demo. Fictional values only. No HSM or CSP connection. Inputs, mappings, and the key stay in page memory; nothing is submitted or saved by this lab.

Side-by-side results

0 / 50 demo mappings

Tokenization

Replace the value with a random reference of the same length. Recovery uses the vault mapping, not decryption.

Input
Demo vault
Token

TOKEN

Awaiting comparison

Random letters and digits, matching the input length.

Length includes spaces and counts Unicode code points. Very short tokens have few possible values. This in-memory vault is not a production security boundary.

Masking

Hide characters in a display value. This reduces what is visible without encrypting the original.

Input
Display rule
Masked view

MASKED VALUE

Awaiting comparison

Values of 4 characters or fewer are fully hidden.

No inverse operation from this output

Hidden characters cannot be recovered from the masked string alone. The original value still exists in the input.

Encryption

Transform the value using AES-256-GCM. Decryption needs the matching key, and authentication detects modified data.

Input
Key + IV
Ciphertext

CIPHERTEXT / BASE64

Awaiting comparison

256-bit key / 96-bit unique IV / 128-bit tag

The IV is public and unique per encryption. Resetting or reloading this page discards the demo key.

Different tools. Different jobs.

Comparison of the three methods in this demo
In this demo	Tokenization	Masking	Encryption
What changes	Value replaced by a random reference of the same length	Characters hidden in the displayed value	Value transformed into ciphertext
How recovery works	Look up the token in the mapping table	Hidden characters are absent from the masked output	Decrypt using the matching key, IV, and authentication tag
Same input again	Same token while its mapping exists	Same output with the same policy	Different ciphertext because each operation uses a unique IV
What must be protected	The original data and access to its mapping	The original data behind the masked view	The key and the surrounding application

This vault-based example preserves length, not character types or spacing. Tokenization does not always preserve length. Masking is not encryption or guaranteed anonymization. Browser cryptography does not provide an HSM security boundary or establish compliance.