# What's hidden in recordings

> How session replay protects user data: masked inputs by default, always-masked passwords, and declarative masking classes.

Source: https://oakdata.co/docs/concepts/replay-privacy

---

Session replay reconstructs what a visitor saw and did, built on [rrweb](https://github.com/rrweb-io/rrweb). A recording can contain whatever was on screen, so OakData masks sensitive content aggressively by default and gives you declarative control over the rest.

The page DOM is masked in the SDK before gzipped chunks are stored.

Masking happens in the browser, before anything is sent - sensitive content is never transmitted or stored.

## Replay is opt-in

Recording is **off until you enable it** per project from the dashboard. The SDK fetches its replay configuration from the server at runtime, so turning replay on or off - or changing masking rules - needs no code change or redeploy.

## What's masked by default

| Name | Type | Description |
| --- | --- | --- |
| `All input values` | masked | Text typed into inputs, selects, and textareas is masked unless you explicitly turn input masking off for the project. |
| `Passwords` | always masked | Password fields are never recorded - even with input masking off. There is no setting that exposes them. |

> **Structure, not secrets** Replay captures DOM structure, layout, and interactions - clicks, scrolls, navigations - so you can see *how* someone used the page. Masking hides the *content* of sensitive fields while keeping the shape of the page intact.

## Declarative masking classes

Add these CSS class names to any element to control how the recorder treats it. Also documented under [autocapture & data attributes](https://oakdata.co/docs/sdk/autocapture).

| Name | Type | Description |
| --- | --- | --- |
| `oak-mask` | mask text | Replaces the element's text with blocks in the recording. |
| `oak-ignore-input` | drop value | Records the input but not what was typed into it. |
| `oak-no-capture` | block subtree | Excludes the element and everything inside it; rendered as a placeholder. |

**masking.html**

```html
<p class="oak-mask">Balance: $12,400.55</p>
<input class="oak-ignore-input" name="card-number" />
<section class="oak-no-capture"><BankDetails /></section>
```

Projects can also configure CSS **block selectors** centrally from the dashboard - suppress whole categories of elements without editing markup.

## How recordings are stored & served

The recorder streams rrweb events into gzipped NDJSON **chunks** in object storage. Fetching a replay through the [REST API](https://oakdata.co/docs/api/rest) or the `get_replay` [MCP tool](https://oakdata.co/docs/api/mcp) returns the recording metadata plus **short-lived signed URLs** (~30 minutes) for each chunk - a player fetches, gunzips, and merges them by timestamp. URLs expire, so fetch them fresh each time you play a recording.