Hashing, Masking, Encryption: How to Pick the Right PII Protection Method

Data engineers often default to hashing personally identifiable information (PII), but the choice of protection technique should depend on what the data still needs to do. Each method — masking, hashing, tokenization, and encryption — sits on a spectrum of reversibility, and selecting the wrong one can leave data exposed or analytically useless. Masking removes the original value entirely and suits display or testing scenarios, while plain hashing is vulnerable to dictionary attacks when the input space is small, as with phone numbers or SSNs. Adding a per-row salt fixes the security gap but breaks cross-table joins, making analytics unreliable. HMAC with a secret key offers a middle ground, enabling consistent pseudonymization while keeping outputs unguessable without the key.