Mask an email address for logs

Keep the first character and the domain; hide the rest of the local part.

JavaScript Version 1.0.0 · MIT · by Oveyon · .md

function maskEmail(address) { return `${address.slice(0, 1)}•••${address.slice(address.lastIndexOf('@'))}`; }

Try in the local lab Download function

Input & expected output

Input

"[email protected]"

Expected output

"a•••@example.com"

The edge case

Input

"[email protected]"

Expected output

"a•••@example.com"

Know the limits

Masking reduces exposure in logs; it is not anonymization, and the domain stays visible.
The mask has a fixed width, so it does not reveal the length of the local part. Prefer logging a message or delivery identifier instead.

The function above is the implementation used by the lab. The lab validates JSON types and caps size before execution; include equivalent validation when accepting untrusted input in your application.

Source & maintenance

The function above is the implementation the lab runs and the tests exercise. Read the license.

Local fixture scope · Node.js 22.23.2 · reviewed October 28, 2026. No external service is required.

Keep exploring

Convert an email domain to punycode — Keep the local part and convert an international domain to its ASCII xn-- form.
Get the domain of an email address — Take the part after the last @ and lowercase it, for domain checks and grouping.
Normalize an email address for comparison — Trim whitespace and lowercase only the domain, preserving the local part.