Data Mask masking types
Key Takeaway
Choose each field's masking type from how testers use the field. Library gives realistic values such as real-looking names, and Pattern gives values in a required format. Random suits fields whose exact value doesn't matter, and Delete suits fields that testing doesn't need.
Data Mask is a managed package that hides sensitive production data after that data is copied into a sandbox. You choose a masking type for each field: Random, Library, Pattern, or Delete. The masking types give different levels of protection, so you match each field's type to how testers need to use that field.
How masking works
You run the masking process from a sandbox created from the production org. Data Mask masks the fields you choose in that sandbox. Production data isn't affected.
For each field, you pick a masking type. The masking type decides how much the masked value still looks like real data.
Data Mask uses nondeterministic obfuscation, which prevents reverse engineering or statistical inference attacks from de-obfuscating the masked data.
Masking is one-way. You can't unmask sandbox data after it's masked. Data deleted from a sandbox can't be restored either. Production is untouched, so the way to recover is to refresh from production and create a new sandbox.