1. A method comprising: storing, in a database maintained on one or more storage devices, a plurality of cryptographically transformed values; receiving a request to access data from the database; determining, from the plurality of cryptographically transformed values, a cryptographically transformed result of the request; determining one or more data characteristics that indicate a data format for masking the cryptographically transformed result, wherein the cryptographically transformed result does not conform to the one or more data characteristics that indicate the data format; without decrypting the cryptographically transformed result, generating, from at least part of the cryptographically transformed result, a masked result that conforms to the one or more data characteristics, wherein the masked result varies based on the at least part of the cryptographically transformed result; wherein the method is performed by one or more computing devices that have been configured to perform the method.