I tried to mask the characters in a creditcard number string using character \'X\'.I wrote two functions as below .The second function uses commons.lang.StringUtils
Firstly, if you make measurements of such a short-running code, you often do not get accurate results due to the minimal timing resolution your CPU/library/whatever provides (which means you usually get to see 0ms or the same small value over and over).
Second and more importantly, do not optimize this! "Premature optimization is the root of all evil" and in a case where you have only a few ms that you want to optimize the effort is thoroughly wasted. You would have to mask millions of credit cards before you should even remotely think about optimizing this simple mask method.