Method, device, and storage medium to receive test data including multiple test strings, wherein the test data is a data set that includes all possible values of input strings to be data masked; encrypt each of the test strings; select a portion of the encrypted test string; compare each portion to the corresponding test string; determine, for each portion, whether the portion of is equal to the corresponding test string; assign the portion as a replacement string when the portion is not equal to the corresponding test string; determine whether each replacement string is unique; store each replacement string that is not unique; generate, for each replacement string that is not unique, an alternate replacement string; and output an alternate replacement string, as a masked string in response to a determination that art input string matches one of the stored test strings associated with one of the alternate replacement strings.