What are the three core data masking and tokenization tools/approaches?

Dynamic data masking, format-preserving encryption, and token vault management.

• Dynamic data masking (DDM): masks sensitive data in real time as it's accessed, showing different views to different users based on authorization — without creating multiple physical copies.
• Format-preserving encryption (FPE): encrypts data while keeping its original format and length, so a 16-digit card number stays a 16-digit value — letting masked data flow through existing applications unchanged.
• Token vault management: a secure system that maps original values to their token replacements, enabling controlled re-identification only when authorized.

Tip: FPE is the trick that lets you protect a field without breaking the database schema or app validation rules that expect a specific format.