function private_str($str){
   $start = 2;
$end = strlen($str) - 10;
   $after = mb_substr($str, 0, $start, 'utf8');
   $repeat = str_repeat('*', $end);
   $before = mb_substr($str, ($start + $end), strlen($str), 'utf8');
   return $after.$repeat.$before;
}
$complate = private_str($pay->user->username);

<td>{{$complate}}</td>