Final answer:
The statement is False. By default, session replay tools do not mask sensitive user input, but it is a best practice to configure them to do so for privacy and data protection reasons.
Step-by-step explanation:
The statement "All user input is masked by default from session replay" is False. Session replay is a feature used in web development and analytics to record and replay users' interactions with a website. By default, most session replay software does not mask sensitive user input, due to the need to capture how users interact with the site. However, due to privacy concerns, the best practice is to configure the session replay tool to mask sensitive inputs such as passwords, credit card numbers, and personal information. This configuration is typically manual and requires specific settings or coding to ensure sensitive data is not captured. Therefore, it is critical to ensure compliance with data protection regulations and best practices in user privacy.