Session replay masking and redaction

Session replay records what your users see. Masking and redaction decide how much of it Sequential keeps. They answer questions like these:

• Can support watch a failed checkout without seeing the card number the user typed?
• Your account page shows each user's name and email. Can you record it and keep those out?
• An API call carries a password-reset token in its query string. Does the token reach the replay's network tab?
• Should your team turn on console message text in production?

The browser and the servers use the same rules file. So the second scrub also covers a recorder that a browser cached before a change, and any other client that sends recordings to your project.

The second scrub cannot unmask or unblock anything. It can only mask more.

• The DevTools rows follow Attribute text, not the preset name. A Custom set-up with Attribute text set to Strict gets the Strict column.
• A network request with no kind, or a kind that Sequential does not know, counts as a file that the page loads.
• Query parameter names stay in every preset, so an address still shows what was asked: ?user_id=[redacted]&page=2.
• In network requests, Sequential keeps the values of the parameters that you list under Keep query values for. Code locations and addresses in text keep no query values.
• In every preset, network addresses lose the #fragment and any user:pass@.
• Under Strict and URLs, a query item with no =, such as ?<uuid>, becomes [redacted]. Under Balanced, Sequential keeps it, unless it looks like a JWT, email address or card number.
• In code locations and in text, a script or other asset file is an address whose last segment ends in a script, stylesheet, image, font, media or .pdf extension, such as .js, .css, .png or .woff2. A .json address counts as a route.
• Console text is kept only while Record message text is on. Error messages are always kept.
• The id rule in text reads each word that holds a /. It masks only what comes after the first / in that word. Prose such as and/or, 2026/09/29 and v1/2 stays as it is. A trailing :line:col stays.

Example, under Strict:

• Each character except a space becomes a solid block (█). A file name such as C:\fakepath\passport_jane_doe.pdf becomes one block for each character.
• Sequential keeps whether a checkbox or radio button is ticked. So the replay still shows the tick.
• The option that a user picks in a drop-down list does not show, under either preset.
• A hidden field's value is masked in page snapshots, in fields that the page adds later, and when a script changes the value later.
• Under Balanced, the value of a checkbox, radio button or drop-down option in the page's HTML is page markup, not user input. Sequential records it as the page has it. The visible label shows the same choice, because Balanced records page text. Strict masks it.
• Only a Custom set-up with Mask all inputs off records input values as users type them.

Masked text shows as solid blocks (█), one per character. Spaces stay in place, so a masked full name still shows as two words. A blocked element becomes an empty box of the same size.

Strict replays look like wireframes. You see the layout and where users clicked, not what they read. Balanced shows your page text and images.

Strict uses an allowlist. An attribute keeps its value only if it is on this list. Sequential masks every other value like text: one █ per character.

Sequential masks attribute values, never attribute names. A name such as data-customer-42 stays as it is.

Under Balanced, attribute values are recorded as they are. The exceptions are the values of hidden fields and file inputs, which both presets mask.

Under Balanced, all of these are recorded as they are.

Under Strict, Sequential keeps the route of the page address. It masks a whole path segment in these cases:

• A UUID, a hex run of 16 or more characters or an email address is anywhere in the segment. Examples are <uuid>.json, <uuid>:activate and uuid:<uuid>. Sequential decodes the segment first, so id%3A<uuid> is masked too.
• The segment is id-like.
• A piece of the segment is id-like, or holds 6 or more digits in a row. Sequential splits a segment into pieces at -, _, ., ~, +, :, ,, ;, @, [, ], (, ), = and ?. Examples are ORD-1234567, 9876543.pdf and id:1234567.

Id-like means one of these:

• a UUID
• 6 or more digits, such as 1234567
• a hex token of 16 or more characters
• a base64 token of 20 or more characters that contains a digit
• an email address
• a JWT

The same rule applies to a stylesheet link, and to API calls and the page itself in DevTools. A stylesheet file name with a build hash, such as app.0123456789abcdef.css, is masked too.

Under Strict, the player cannot load what the masked addresses pointed to:

• Web fonts do not load. The replay shows fallback fonts.
• CSS background images do not show.
• CSS rules that select on a masked attribute value stop matching, such as [data-variant="primary"] or [title="Close"]. Rules on id, class and the state values above still match, such as [data-state="open"].
• A stylesheet whose file name has a build hash cannot load, if the recorder could not copy its CSS. The recorder usually copies it.
• In DevTools, the address of a file that the page loads shows only its domain and masked path segments. To find a file that failed, reproduce the issue in a browser, or use a Custom set-up with Attribute text set to URLs on a staging project.

Balanced has none of these costs.

Custom is any other combination. Open Advanced selectors to set these six settings:

• Mask all inputs
• Mask text selector (CSS)
• Block selector (CSS)
• Record canvas
• Collect fonts
• Attribute text (see the next section)

If you choose Strict or Balanced, the preset overwrites all six. If you edit any of them, the preset changes to Custom.

The summary line at the top of the tab shows "custom masking" whenever the saved six settings do not match Strict or Balanced exactly.

If a Mask text selector or Block selector is not valid CSS, Sequential records nothing rather than record unmasked content.

• On save in the app. Your browser checks the selector. Save stays disabled, and the field says which parts are not valid, for example "##x" is not a valid CSS selector.
• On save through the API. Sequential's server checks the selector with its own parser. It refuses only what that parser can tell is invalid, such as ##x, with a 422 invalid_config error that names those parts. Some selectors that browsers refuse still save, for example #2nd-step, .a..b or div:nope. Then nothing is recorded. So check a selector in the app before you send it through the API. The parser also refuses a few forms that browsers accept, such as an attribute bracket left open at the end: [data-x.
• In the visitor's browser. Before it records, the recorder tries both selectors in the visitor's browser. If the browser refuses either one, that page is not recorded. The browser console shows one line: [sequential] replay: masking_selector_invalid. Browsers differ a little in what they accept, so a selector can fail in only some browsers.
• A selector saved earlier. If a stored selector is not valid in your browser, Session replay settings show "Recording is off: the saved block selector isn't valid in browsers", with the parts that are not valid. Fix it under Advanced selectors and click Save.

One invalid part stops the whole list from working, so check each part, for example #2nd-step (an id cannot start with a digit) or .a..b.

Attribute text is under Masking → Advanced selectors, on the Web tab. It sets attribute masking on its own. It also sets how DevTools shortens addresses. It has three choices:

• Choosing Strict sets it to Strict. Choosing Balanced sets it to Off.
• URLs is a Custom choice only. If you choose it, the preset changes to Custom.
• A change from Strict to URLs or Off, or from URLs to Off, records more. When you save, the Loosen masking? sheet asks you to confirm with the project slug.
• A project saved before this setting existed gets Strict if its preset is Strict or Custom, and Off if its preset is Balanced.

Owners and admins can also change masking through the settings API, with PATCH /api/projects/:id/config. The app's settings form never sends the combination below.

• If a request names the preset strict and also sets mask_attributes to urls or off, Sequential refuses it with 400 masking_preset_conflict. It saves nothing.
• The message is: preset "strict" cannot be combined with a looser mask_attributes; send preset "custom" to loosen. The fields list names mask_attributes.
• To loosen attribute masking, send the preset custom. If the change records more than before, also send confirm with the project slug.
• Sequential checks only mask_attributes in this way. If a request names strict and loosens a different masking setting, such as mask_all_inputs, Sequential saves it as custom. If that records more than before and the request has no confirm with the project slug, the API answers 403 confirm_required and saves nothing.
• A stored configuration can say strict and have a looser mask_attributes, for example from before this check. Sequential then applies strict attribute masking. It does not change the other settings.

Both presets mask the name of a file that a user picks to upload, such as passport_jane_doe.pdf. Only a Custom set-up with Mask all inputs off records it.

Some sign-in flows put an access token in the #fragment. Sequential drops the fragment from network request URLs. Under Strict, the replay's page address has no fragment and no query. Under Balanced, the replay's page address keeps them.

Strict masks the replay's page address only. Your analytics events keep their own page URL, cleaned as Page URLs describes.

Under Balanced, Sequential records every attribute value as it is, except the values of hidden fields and file inputs. Examples:

• Link targets, mailto: addresses included.
• title, aria-label, placeholder, alt and data-* values.
• The labels of <input type="submit"> and type="button" buttons.
• The value of checkboxes, radio buttons and drop-down options.

Under Strict, Sequential masks all of these.

Under both presets, a blocked element keeps none of its attributes except class.

What to mark:

• data-sq-mask: anything that shows personal data, such as a profile header or an address block.
• data-sq-private: the same kind of element, when its text must also stay out of click events, such as an account menu with the person's name.
• data-rr-block: anything that must never be captured, such as a document preview, an API key on screen, or profile photos under Balanced.

The Loosen masking? sheet opens if the change records more (for example, Strict to Balanced). It lists what Sequential will now record.

The sheet shows the slug, for example "Type web-shop to confirm." Click Copy next to it to copy it. The text must match exactly. A space at the end keeps Apply unavailable.

Every save appears in the Audit log.

On iOS and Android, PostHog's mobile SDK masks on the device. Its defaults are private. You set the masking in your app's code. The project's masking settings do not apply.

Attribute masking (mask_attributes) does not apply to mobile recordings. They are not web pages and carry no HTML attributes. The mobile SDK's own masking still masks them.

On the iOS and Android tabs, the settings are disabled and show this message: "Compile-time in the PostHog mobile SDK — not remote-configurable."

Mobile apps covers the SDK's defaults and how to mask your own views.

Redaction replaces these values with [redacted]:

• JWTs.
• Bearer and Basic credentials. The word Bearer or Basic stays.
• Email addresses.
• 15- and 16-digit card numbers that pass the card-number checksum. The digits can be one run, or have a single space, dash or + between them.
• In objects your app logs to the console, the value under a key such as password, secret, token, auth, cookie, session or apikey. This does not work on an object your app turns into a string first, such as JSON.stringify(user).

Redaction catches only the exact shapes above. The exception is a value under a sensitive key in a logged object. Redaction also misses a recognisable value in a slightly different form.

These are kinds of gap, not a complete list:

• A JWT written straight after a letter, digit, _ or -.
• A JWT whose dots are encoded in console or error text (%2E, .).
• A Bearer or Basic credential shorter than 8 characters.
• A Bearer or Basic credential joined to the word by anything other than a space (Bearer:…, or Bearer%20… in console or error text).
• An email address with an accented or other non-ASCII letter (josé@…, …@münchen.de). Redaction misses all of the address, or part of it.
• An email address written with %40 in console or error text.
• A card number of another length, or split another way: two spaces, -, a tab, a non-breaking space or dots between the groups.
• An object your app turns into a string before it logs it (JSON.stringify(user)). The result is text, so redaction does not check its keys.

Sequential stores each request's method, URL, status, timing and size. It never stores the headers or the body.

Two lists control the URL:

• They are under Network requests in the DevTools group of the Session replay tab.
• They work only while Network requests is ticked.
• Each list takes one entry per line.

When you add a parameter to Keep query values for, Sequential asks for the project slug.

• Parameter names stay. For a redacted value, the request detail in a replay shows "value not recorded".
• Under Strict and URLs, a query item with no = (such as ?a1b2c3) becomes [redacted]. Under Balanced, Sequential keeps it, unless it looks like a JWT, email address or card number.
• If a kept value contains a JWT, a Bearer or Basic credential, an email address or a card number, Sequential replaces the whole value with [redacted].
• Sequential drops the #fragment and any user:pass@.
• Sequential replaces a path segment that looks like a JWT, email address or card number.
• Attribute text also changes the path. Under Strict, a file that the page loads keeps only its domain and has no query, and an API call keeps its route. See What each preset masks.

Pattern syntax. Patterns match the full URL without its query. * stays within a path segment. ** crosses segments.

Errors and console entries. Script URLs and stack traces keep no name=value query values. Each value becomes [redacted], whatever Keep query values for lists. A query item with no = follows the same rule as in request URLs.

Without Record message text, each console entry keeps:

• its level,
• how often it happened,
• where it was logged,
• a stack trace, for warnings and errors.

Settings are per project. Separate staging and production projects give you both (Organisations, projects and keys).

1. Go to Settings → Projects → your project → Session replay.
2. Under DevTools, make sure that Console is ticked. It is ticked by default.
3. Tick Record message text.
4. Click Save.
5. In the Loosen masking? sheet, type the project slug in Project slug.
6. Click Apply.

• Turning it off stops Sequential from storing new text. It does not remove text that is already stored. Retention and deletion covers what happens to existing recordings.
• While it is off, Sequential's servers empty message text as it arrives. This includes text from an older recorder or a mobile SDK that sends it anyway.
• Sequential asks iOS and Android apps for logs only while it is on.

Keep personal data out of the errors your code throws.

The judge never sees the replay's copy of an error. At most, it sees how many errors there were.

If you also send an error as an analytics event, the judge can see a short excerpt of it. For example, the Sequential SDK's captureException sends one. AI and third parties covers this.