Text (Encrypted) should be used to create Encrypted field in Salesforce.
Select Mask Type and Mask Character.
Implementation Notes
1. In Salesforce, the Encrypted fields are encrypted with 128-bit master keys and use the Advanced Encryption Standard (AES) algorithm. You can archive, delete, and import your master encryption key. To enable master encryption key management, contact Salesforce.
2. You can use encrypted fields in the email templates but the value is always masked regardless of whether you have the “View Encrypted Data” permission.
3. If you have created encrypted custom fields, make sure your organization has secure connections using SSL (Secure Sockets Layer) enabled.
4. If you have the “View Encrypted Data” permission and you grant login access to another user, be aware that the other user will be able to see encrypted fields unmasked (in plain text).
5. Only users with the “View Encrypted Data” permission can clone the value of an encrypted field when cloning that record.
6. Only the <apex:outputField> component supports presenting encrypted fields in Visualforce pages.
Restrictions
Encrypted text fields have the following restrictions:
1. Salesforce Encrypted fields cannot be unique, have an external ID, or have default values.
2. In Lead Conversion mapping, they are not available for mapping to other objects.
3. They are limited to 175 characters because of the encryption algorithm.
4. They are not available for use in filters such as list views, reports, roll-up summary fields, and rule filters.
5. They cannot be used to define report criteria, but they can be included in report results.
6. They are not searchable, but they can be included in search results.
7. They are not available for: Salesforce Classic, Connect Offline, Connect for Outlook, Salesforce for Outlook, lead conversion, workflow rule criteria or formulas, formula fields, outbound messages, default values, and Web-to-Lead and Web-to-Case forms.
Best Practices
1. Encrypted fields are editable regardless of whether the user has the “View Encrypted Data” permission. Use validation rules, field-level security settings, or page layout settings to prevent users from editing encrypted fields.
2. You can still validate the values of encrypted fields using validation rules or Apex. Both work regardless of whether the user has the “View Encrypted Data” permission. Data for encrypted fields in the debug log isn’t masked because users who have access to the debug logs have access to all data in the organization.
3. Existing custom fields cannot be converted into encrypted fields nor can encrypted fields be converted into another data type. To encrypt the values of an existing (unencrypted) field, export the data, create an encrypted custom field to store that data, and import that data into the new encrypted field.
4. Mask Type is not an input mask that ensures the data matches the Mask Type. Use validation rules to ensure that the data entered matches the mask type selected.
5. Use encrypted custom fields only when government regulations require it because they involve additional processing and have search-related limitations.