public class Employee {
    private String username;
    **private String password; //mask this field**
    private String city;
}

public class Employee {
    private String username;
    private String password;
    private String city;

    @Override
    public String toString() {
        return "username=" + username + " city=" + city;

    }

    public static void main(String[] args) {
        System.out.println(new Employee().toString());
    }
}

String maskedPassword = s.replaceAll("password=[^&]*", "password=***");

public class MaskedString(){
    private String maskedString;

    MaskedString(){
        maskedString = "";
    }

    MaskedString(String string){
        maskedString = string;
    }

    public String getActualString(){
        return maskedString;
    }

    public String setString(String string){
        maskedString = string;
    }

    public String toString(){
        return "Not the actual string!";
    }
}