diff --git a/server/auth_audit.go b/server/auth_audit.go
index a062eac..d637301 100644
--- a/server/auth_audit.go
+++ b/server/auth_audit.go
@@ -42,7 +42,7 @@ func recordSessionLoginSuccess(s *Session, rec *auth.Rec, scheme, suppliedAccoun
 	}
 	event := &types.LoginAuditEvent{
 		UserID: rec.Uid, Username: username, AccountType: accountType,
-		AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
+		AccountHash: hashLoginAccount(account), AccountMask: account,
 		LoginType: loginAuditType(scheme), EventType: "login", SessionID: truncateAuditValue(s.sid, 96),
 		DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
 		AppVersion: truncateAuditValue(versionToString(s.ver), 32), IP: sessionAuditIP(s.remoteAddr),
@@ -79,7 +79,7 @@ func recordSessionLoginFailure(s *Session, scheme string, secret []byte, rec *au
 		riskLevel = "high"
 	}
 	event := &types.LoginFailureEvent{
-		UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: maskLoginAccount(account),
+		UserID: uid, AccountType: accountType, AccountHash: hashLoginAccount(account), AccountMask: account,
 		FailureType: failureType, Reason: reason, Detail: truncateAuditValue(loginFailureDetail(cause), 500),
 		IP: sessionAuditIP(s.remoteAddr), DeviceID: truncateAuditValue(s.deviceID, 255), Platform: normalizeAuditPlatform(s.platf),
 		AppVersion: truncateAuditValue(versionToString(s.ver), 32), UserAgent: truncateAuditValue(s.userAgent, 512),
@@ -241,24 +241,6 @@ func isPhoneLike(value string) bool {
 	return digits >= 7
 }
 
-func maskLoginAccount(account string) string {
-	account = strings.TrimSpace(account)
-	if account == "" {
-		return ""
-	}
-	if at := strings.LastIndex(account, "@"); at > 0 {
-		return string([]rune(account[:at])[:1]) + "***" + account[at:]
-	}
-	runes := []rune(account)
-	if isPhoneLike(account) && len(runes) > 7 {
-		return string(runes[:3]) + "****" + string(runes[len(runes)-4:])
-	}
-	if len(runes) <= 2 {
-		return strings.Repeat("*", len(runes))
-	}
-	return string(runes[:1]) + strings.Repeat("*", len(runes)-2) + string(runes[len(runes)-1:])
-}
-
 func hashLoginAccount(account string) string {
 	account = strings.ToLower(strings.TrimSpace(account))
 	if account == "" {
diff --git a/server/auth_audit_test.go b/server/auth_audit_test.go
index 962e260..1aee4c6 100644
--- a/server/auth_audit_test.go
+++ b/server/auth_audit_test.go
@@ -22,18 +22,7 @@ func TestLoginAuditAccountDoesNotTreatTokenAsAccount(t *testing.T) {
 	}
 }
 
-func TestMaskAndHashLoginAccount(t *testing.T) {
-	tests := map[string]string{
-		"13800138000":       "138****8000",
-		"alice@example.com": "a***@example.com",
-		"alice":             "a***e",
-		"ab":                "**",
-	}
-	for input, want := range tests {
-		if got := maskLoginAccount(input); got != want {
-			t.Errorf("maskLoginAccount(%q)=%q want %q", input, got, want)
-		}
-	}
+func TestHashLoginAccount(t *testing.T) {
 	hash := hashLoginAccount(" Alice ")
 	if len(hash) != 64 || hash != hashLoginAccount("alice") || strings.Contains(hash, "alice") {
 		t.Fatalf("unexpected account hash %q", hash)