mask userdata in step 2