Why does an LWC show unmasked values for encrypted fields?

Lightning Web Components do not automatically enforce encrypted field visibility. Apex queries can read decrypted values, so you have to evaluate the user's permissions yourself and mask the field before returning it to the component.

How do you check the View Encrypted Data permission in Apex?

Query PermissionSetAssignment for the current user ID where PermissionSet.PermissionsViewEncryptedData equals true. If the query returns at least one record, the user is authorized to view unmasked data.

How do you mask an SSN in Apex for unauthorized users?

When a user lacks the View Encrypted Data permission, use Apex string methods to replace the leading digits with a mask pattern and return only the last four digits (such as '***-***-' followed by the trailing four characters).

Display Encrypted SSN in LWC Securely

Encrypted fields do not stay masked on their own once Apex has read them. Here is the pattern for a Lightning Web Component: check the View Encrypted Data permission in Apex, format or mask the SSN there, and hand the component a string that is already safe to render.

Why this matters

Encrypted fields in Salesforce (like SSN) are protected: only users with the View Encrypted Data permission should see the full value. Lightning Web Components (LWC) do not automatically enforce encrypted field visibility, so both the permission check and the masking have to happen in Apex before the value reaches the client. That is what keeps the display in line with your security policies and prevents accidental exposure of sensitive data.

Approach overview

The recommended pattern has three steps:

Check whether the current user has the View Encrypted Data permission (via PermissionSetAssignment).
Format or mask the SSN in Apex depending on that permission.
Return the safe, formatted string to the LWC for display.

Key Apex utilities

Two utility methods do the work: one checks the permission, the other sanitizes (masks) the SSN when the check fails.

Check View Encrypted Data permission

public static Boolean userHasEncryptedData(Id userId) { // Query permission set assignments that grant View Encrypted Data List psaEncrypt = [ SELECT Id FROM PermissionSetAssignment WHERE PermissionSet.PermissionsViewEncryptedData = true AND AssigneeId = :userId WITH SYSTEM_MODE ]; // Return true if at least one matching permission set assignment exists return !psaEncrypt.isEmpty(); }

Sanitize / mask SSN when user lacks permission

public static String sanitizeEncryptedData(Boolean hasEncryptedData, String stringToSanitize){ if(!hasEncryptedData && stringToSanitize != null){ // Mask all but last 4 digits (format: ***-***-1234) return '***-***-' + stringToSanitize.right(4); } else { // User is authorized or value is null, return original return stringToSanitize; } }

Apex controller for LWC

Combine the utilities in a controller method that the LWC can call. This example assumes the SSN field API name is SSN__c on Lead.

public with sharing class LeadSSNController { @AuraEnabled(cacheable=true) public static String getFormattedSSN(Id leadId) { // Get current user Id Id currentUserId = UserInfo.getUserId();

    // Check permission
    Boolean hasEncryptedData = userHasEncryptedData(currentUserId);

    // Fetch Lead's SSN (encrypted field)
    Lead leadRecord = \[SELECT SSN\_\_c FROM Lead WHERE Id = :leadId LIMIT 1\];

    // Return formatted (masked or full) string
    return sanitizeEncryptedData(hasEncryptedData, leadRecord.SSN\_\_c);
}

}

Lightning Web Component (LWC)

The LWC calls the Apex method and displays the string it gets back, already formatted.

leadSSN.js

import { LightningElement, api, wire, track } from 'lwc'; import getFormattedSSN from '@salesforce/apex/LeadSSNController.getFormattedSSN';

export default class LeadSSN extends LightningElement { @api recordId; @track formattedSSN;

@wire(getFormattedSSN, { leadId: '$recordId' })
wiredSSN({ error, data }) {
    if (data) {
        this.formattedSSN = data;
    } else if (error) {
        console.error('Error fetching SSN:', error);
        this.formattedSSN = 'Error loading SSN';
    }
}

}

leadSSN.html

Best practices & testing

Set your encrypted field (SSN__c) up correctly in Salesforce, and give View Encrypted Data only to the profiles and permission sets that need it.
Unit test Apex methods to validate both branches (authorized and unauthorized users).
Use with sharing on controllers when appropriate and avoid returning raw sensitive values to the client.
Log access carefully (avoid logging full SSNs) and follow your org's data retention and audit policies.

Conclusion

By validating the View Encrypted Data permission in Apex and masking SSNs before they are returned to the LWC, you display sensitive information only to authorized users. The pattern keeps the client side simple and centralizes the security logic in Apex, which makes it easier to test and audit.

The same pattern reads differently depending on your seat. Admins control who can see full encrypted data via permission sets. Developers get a safe pattern to follow when a component has to render a sensitive field. Business users get a consistent UI showing either a masked or a full SSN depending on their access, which protects sensitive customer data while enabling legitimate business use.

Handling Encrypted SSN in LWC: Show Full or Masked SSNs Based on User Permission

Why this matters

Approach overview