code: public static String maskExcept(final String s, final int unmaskedLength, final char maskChar) {
          if (s == null) {
              return null;
          }
          final boolean maskLeading = unmaskedLength > 0;
          final int length = s.length();
          final int maskedLength = Math.max(0, length - Math.abs(unmaskedLength));
          if (maskedLength > 0) {
              final String mask = StringUtils.repeat(maskChar, maskedLength);
              if (maskLeading) {
                  return StringUtils.overlay(s, mask, 0, maskedLength);
              }
              return StringUtils.overlay(s, mask, length - maskedLength, length);
          }
          return s;
      }
docs: Returns a masked string, leaving only the given number of characters unmasked.
  
  @param s
  string that requires masking
  @param unmaskedLength
  number of characters to leave unmasked; if positive, the unmasked characters are
  at the end of the string, otherwise the unmasked characters are at the start of
  the string.
  @param maskChar
  character to be used for masking
  @return a masked string