Greenmask

Visit Website

Introduction

Greenmask describes itself as ‘a powerful open-source utility for logical database dumping, anonymization, synthetic data generation, and restoration’, according to its README. It is designed for PostgreSQL, where it is production-ready, and MySQL, which is a work in progress in beta. It is stateless and creates logical backups compatible with standard tools such as pg_dump and mysqldump.

The core idea is to act as a proxy around logical dumps. Greenmask reads data from the source database, applies transformations defined in a YAML configuration to sensitive columns, and writes a dump that standard restore tools can load. Because transformations happen during the dump, the masked copy never contains raw personal data, and the production database itself is not modified.

Transformations are rich. Built-in transformers replace values with random or realistic data, hash them, mask parts of strings, add noise to numbers and dates, or set values from templates. Deterministic transformation uses hash functions so the same input always gives the same output, which keeps joins and foreign keys consistent across tables and across repeated runs. Dynamic parameters let a transformer depend on other columns, for example keeping created_at earlier than updated_at. Conditions apply transformations only to rows that meet criteria, and transformation inheritance automatically applies rules to partitioned tables and foreign key references. Custom transformers can be written in any language or with templates.

Database subsetting creates smaller, referentially intact databases for development, with support for cyclic and polymorphic references, which is often the hardest part of building realistic test databases from production. Storage is agnostic: dumps can be written to local directories or S3-compatible storage such as AWS S3, MinIO or GCS. Greenmask uses native database drivers for encoding and decoding to preserve type safety, and ships as a single cross-platform binary and Docker image.

The README lists four use cases: sensitive data sanitisation for staging, analytics and testing; backup and restore as a drop-in replacement for pg_dump/pg_restore and mysqldump; local development with lightweight subsets; and synthetic data generation from scratch using the CMD transformer and custom transformations. Release v0.2.26 shipped in October 2026, with commits in November 2026, and the project has about 1,800 GitHub stars.

In the quality loop, Greenmask sits at the integration stage, feeding staging, QA and developer environments with realistic but safe data, and supports security and privacy requirements such as keeping production PII out of test systems.

The source code is at GreenmaskIO/greenmask on GitHub under the Apache-2.0 licence, with about 1,800 stars; the most recent commit was on 6 November 2026.

Masking is only as good as its coverage, so teams adopting Greenmask should add a review step whenever the schema changes: a new column holding phone numbers or free-text notes can leak data if no transformer is assigned.

Features

1. Logical dump proxy: Compatible with pg_restore and standard tools.
2. Rich transformers: Random, hash, mask, noise and template values.
3. Deterministic masking: Consistent output for joins and repeated runs.
4. Dynamic parameters: Keep related columns logically consistent.
5. Conditional rules: Transform only matching rows.
6. Transformation inheritance: Partitions and foreign keys handled.
7. Subsetting: Referentially intact smaller databases.
8. S3-compatible storage: Local, AWS S3, MinIO, GCS.
9. Custom transformers: Any language or templates.
10. Single binary: Cross-platform with a Docker image.

Pros

1. Open source and free: No licence costs.
2. Production stays untouched: Masks during dump.
3. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
4. Actively maintained: The repository had commits as recent as 6 November 2026.

Cons

1. PostgreSQL first: MySQL support is beta.
2. Configuration effort: Rules must cover every sensitive column.
3. Pre-1.0: Version 0.2.x; check upgrade notes.

Usage and Links (Example)

# greenmask config (excerpt)
dump:
  transformation:
    - schema: public
      name: users
      transformers:
        - name: Hash
          params:
            column: email
        # see the docs for the full list of transformers

greenmask --config config.yml dump
greenmask --config config.yml restore latest

Practical tips:

1. Inventory sensitive columns first and review the config like code.
2. Use deterministic transformers for keys that join across tables.
3. Combine subsetting with masking to keep developer databases small.
4. Try the sandbox: docker-compose run greenmask from the repository.

Resources:

• Greenmask website
• GitHub repository

Pricing

Greenmask is free and open source under the Apache-2.0 licence.

Recommended for?

1. PostgreSQL teams needing safe, realistic test databases.
2. Platform teams building self-service staging refreshes.
3. Not a fit for databases other than PostgreSQL or (beta) MySQL.

Conclusion

Greenmask is a strong open-source option for masking and subsetting PostgreSQL data during dumps, with thoughtful features for consistency and referential integrity.

Plan time to model every sensitive column, and treat the configuration as a reviewed, versioned artefact.

On CheckOps, Greenmask is filed under the Integration testing and Security testing stages. Related tools listed here include PostgreSQL Anonymizer, Tonic Structural, Delphix, DATPROF, K2view Test Data Management and Testcontainers. Before choosing, compare them on licence, supported languages and platforms, hosting model, and how well each fits your existing CI pipeline. Facts on this page were checked against the official website, documentation and repository on 11 November 2026; statements the vendor makes about its own product are marked as vendor claims.