How to mask certain string attributes in Java during logging?

[Vinod Vijay]

I want to understand if there is anyway I can mask certain string variables of a class like password, etc which will prevent during logging. Like overriding .toString() method in such way it does not print in logs.

For instance:-

We have a class Employee with following fields:-

public class Employee { private String username; private String password; //mask this field private String city; }

During logging like

LOGGER.INFO("printing object:"+employee);

Here in logging, I'm trying to print the whole object, Employee here and my requirement is it should not print out masked field, password at all and whereas logging of rest of the fields are fine.

Thank you,

[Campbell Ritchie]

So, what happens when you print out an instance of this class? Does it print the password?
What is the toString method like?
Why have you got a password as a field in the first place? Why have you stored the password as a String?