Support opens a customer record to confirm a payment. On screen is a full 16-digit card number, or a complete IBAN, or a national ID. Nobody needed to see all of it — they needed the last three digits to confirm they had the right account. The rest is risk sitting on a screen in an open-plan office.
What Directus gives you today
Directus does have masking: the Formatted Value display has a Mask option. It has two limits that matter here.
First, it is all or nothing. A masked value renders as a fixed ********** — ten asterisks, whatever the real value was. That is genuinely private, and also useless for the common case, because an agent looking at three masked accounts cannot tell which is which.
Second, it is a display, not an interface. Displays render values in list views and other read-only contexts. Open the record and the edit form shows the raw value again.
Partial masking, in the edit form
Directus Masked Value is a free open-source interface for string and text fields that masks the value in the form, keeping just enough of it to be useful:
**********786
The agent can confirm the account. The number on the screen is not the number. The value in the database is unchanged — this is presentation, not transformation.
Options
- Visible characters — how many stay readable.
- Position — at the end (
*****786) or the start (786*****). - Mask character — any character you like.
- Preserve length — off, the mask is a fixed width, so the real length is hidden too.
- Reveal toggle — an optional eye icon for a deliberate, momentary look.
- Monospace — for account numbers and IBANs, where digits should line up.
Editing without corrupting the data
The obvious failure mode for a masking interface is saving the mask over the real value. This one cannot: focusing the input reveals the true value for editing, and changes are only emitted while it is visible. Blur it and the mask returns.
Be honest about what masking is
Masking is a shoulder-surfing control, not a security boundary. Anyone with read permission on the field can still fetch the raw value from the API. If the requirement is that some roles must never see the value, that is a permissions problem, and Directus already solves it with field-level permissions. If the value never needs reading back at all, use the hash special.
Use this where the data is legitimately readable by the role, but should not sit in plain sight on a screen all day.
Installing it
Open Settings → Marketplace in Directus, search for @contensu/directus-extension-masked-value-interface, and press Install. Then set a string or text field's interface to Masked Value.
MIT-licensed and free. Built because we needed it on a client project, and released because everyone else does too.
Common questions
Does Directus already have a way to mask field values?
Partly. The Formatted Value display has a Mask option, but it replaces the entire value with a fixed ten asterisks and only applies where a display is used, such as list views. It cannot show the last few characters, and it does not apply in the edit form.
Is masking the same as encrypting or hiding a field?
No. Masking is presentation only. Anyone with read permission on the field can still read the raw value through the API. For real secrecy use field-level permissions, or the hash special for values that never need to be read back.
Can an editor still change a masked value?
Yes. Focusing the input reveals the real value so it can be edited, and edits are only emitted while the real value is visible, so the mask itself can never be saved over the data.
How many characters stay visible?
It is configurable, along with whether they sit at the start or the end, which character does the masking, and whether the mask preserves the real length or uses a fixed width that hides it.
Need an interface Directus does not ship?
This one is free, and so is every extension we publish. The paid work is the one that does not exist yet — the field your editors keep asking for, built to behave like the rest of the admin app rather than bolted on beside it. Tell us what the field has to do.
Tell us what you need →