Encrypted Custom Fields are a new field type (released after winter 08) that allows users to store sensitive data in encrypted form and apply a mask when the data is displayed (e.g., Credit Card Number: XXX-XXX-XX-1234).
Implementation Notes
1. Encrypted fields are encrypted with 128-bit master keys and use the Advanced Encryption Standard (AES) algorithm. You can archive, delete, and import your master encryption key. To enable master encryption key management, contact Salesforce.
2. You can use encrypted fields in email templates but the value is always masked regardless of whether you have the "View Encrypted Data" permission.
3. If you have created encrypted custom fields, make sure that your organization has "Require secure connections (HTTPS)" enabled.
4. If you have the "View Encrypted Data" permission and you grant login access to another user, the user can see encrypted fields in plain text.
5. Only users with the "View Encrypted Data" permission can clone the value of an encrypted field when cloning that record.
6. Only the <apex:outputField> component supports presenting encrypted fields in Visualforce pages.
Restrictions
Encrypted text fields:
1. Cannot be unique, have an external ID, or have default values.
2. For leads are not available for mapping to other objects.
3. Are limited to 175 characters because of the encryption algorithm.
4. Are not available for use in filters such as list views, reports, roll-up summary fields, and rule filters.
5. Cannot be used to define report criteria, but they can be included in report results.
6. Are not searchable, but they can be included in search results.
7. Are not available for: Salesforce Classic Mobile, Connect Offline, Salesforce for Outlook, lead conversion, workflow rule criteria or formulas, formula fields, outbound messages, default values, and Web-to-Lead and Web-to-Case forms.
8. User profiles who have the "View Encrypted Data" configuration enabled will be able to view the field normally.
9. Users who do not have the "View Encrypted Data" profile will see the mask.
10. User profiles that have the "Modify All Data" permission will not be able to see the value of encrypted data fields.
11. The field length is restricted to 175 characters in size.
12. Encrypted Field cannot be type cast as Unique or External ID.
13. An encrypted field cannot be configured with a default value.
14. You can't use encrypted fields in report filters and list views.
15. You can't use the encrypted fields in SOQL "where/order" clauses.
16. Also we can not use encrypted field formula fields, workflow rules, workflow field updates, approval process entry criteria, and approval step criteria.
17. If you clone a record that has encrypted custom fields, Salesforce will copy the data from the field ONLY if the user has the "view encrypted data" permission.
You can access the data of encrypted field in apex, i.e value is always unmasked.
Best Practices
1. Encrypted fields are editable regardless of whether the user has the "View Encrypted Data" permission. Use validation rules, field-level security settings, or page layout settings to prevent users from editing encrypted fields.
2. You can still validate the values of encrypted fields using validation rules or Apex. Both work regardless of whether the user has the "View Encrypted Data" permission.
3. Encrypted field data is not always masked in the debug log. Encrypted field data is masked if the Apex request originates from an Apex Web service, a trigger, a workflow, an inline Visualforce page (a page embedded in a page layout), or a Visualforce email template. In other cases, encrypted field data isn't masked in the debug log, like for example when running Apex from the Developer Console.
4. Existing custom fields cannot be converted into encrypted fields nor can encrypted fields be converted into another data type. To encrypt the values of an existing (unencrypted) field, export the data, create an encrypted custom field to store that data, and import that data into the new encrypted field.
5. Mask Type is not an input mask that ensures the data matches the Mask Type. Use validation rules to ensure that the data entered matches the mask type selected.
6. Use encrypted custom fields only when government regulations require it because they involve more processing and have search-related limitations.
