That's Java 11 or later

Is checking for null or returning string smaller/equal 4 must have?
I did code like this and it has no error with empty string and properly showing 1-4 character strings

You could use the string repeat function tocreatedthe masked part

here better to use StringBuilder.

put str.kength() in an integer variable for more neat code

String concatenations are expensive.

Compiler won't do StringBuilder magic on this one most likely. In general that loop gets turned into:

String result = "";
for (int i = 0; i < str.length()-4; i++) {
result = new StringBuilder().append(result).append('#').toString();
}

worth to put str.length()-4 into a variable for better performance

That's a ton of String objects created and thrown away (or hope for the compilers StringBuilder replacement magic)