A computer-implemented method includes receiving a request for a webpage together with an identifier for a web session and determining that the web session has expired. Information entered by a user that would have appeared in the webpage before the web session expired is retrieved and at least some of the retrieved information is partially masked in response to the determination that the web session has expired. The webpage is then returned with the partially masked information.