# Redact sensitive fields

A capture stores every field on the page, including the ones that have nothing to do with consent. Redaction is how you keep sensitive values out of it.

Redaction happens in the browser, before anything is uploaded, so a redacted value is not sent. That also makes it permanent: there is no privileged copy, and you cannot recover the value later either. Redact narrowly.

## Tag the field

Put `data-ec-redact` on the element whose value must not be stored.

```html
<input type="password" name="password" data-ec-redact="full" />

<input
  type="text"
  name="card"
  autocomplete="cc-number"
  data-ec-redact="pan-last4"
/>
```

Two modes:

- **`full`** replaces the value with `••••`. Use it unless you have a reason not to.
- **`pan-last4`** replaces every digit except the last four, and only when the value holds at least twelve digits in total. Below that, every digit goes. It exists for the case where a support agent needs to recognise which card was used. It masks digits only, so any letters or punctuation in the value survive; use `full` where the surrounding text is also sensitive.

The attribute has to carry a value. A bare `data-ec-redact` with nothing after it redacts nothing, which is the failure most likely to go unnoticed, since the markup looks tagged. A misspelt value errs the safe way: anything that is neither `none` nor a spelling of `pan-last4` is treated as `full`.

There is a third, stronger mode. `data-expressconsent-mask` empties the value outright rather than substituting bullets, and it outranks both of the above. It is the one to reach for when even the shape of the value matters.

## What to redact, and what not to

**Redact:** passwords, payment card numbers, card security codes, bank account and routing numbers, government identifiers, one-time codes, health information, and anything your own policy says cannot be retained for five years.

**Do not redact:** the consent language, the consent checkbox, the submit control, or the contact details the consent is *about*. A record with a redacted phone number cannot be tied to the person now saying they never agreed, which is the only question the record exists to answer. Redact narrowly enough that the record still answers it.

## Next

- [Tagging a form](https://app.expressconsent.com/docs/tags): Mark the disclosure, the checkbox, and the submit control so a record carries structured consent facts.