Create a Protected Custom Field
To create a new protected custom field that can be used in any space:
With the new field created, you can now add it to a field configuration.
Protected Custom Fields encrypts values when they're entered into a protected custom field in the Jira UI.
If a protected field is updated any other way, such as through the REST API, an automation rule, or Rovo, the new value is saved as plain text within the same field. It replaces the protected value and can be seen by anyone who can open the work item. This is expected behaviour.
If this happens, your original encrypted value is still recoverable. The encrypted string will show up in your work item history, and can be pasted back into the field via the UI, and will once again only be readable to anyone with authorisation, based on their user group.
Reading is different. Once a value is encrypted, only users in the groups you've authorised can decrypt it. Anyone else trying to read it, whether through the REST API, board view, Rovo, or any other method, will only see encrypted text.
To keep your values protected, check what can write to your protected fields, and limit who can run automations or integrations against them.