PII Redactor
"Mail [email protected] or call 010-1234-5678." becomes "Mail [EMAIL_1] or call [PHONE_1].". Paste your own text, copy the masked version into any chat, then paste the reply back to restore the real values. National IDs such as the US SSN, India's Aadhaar (Verhoeff check) or Brazil's CPF (two mod-11 digits) are validated by their own check digits, so random numbers are left alone. Matching is pattern-based and will miss names and addresses.
How to use
- Paste your text. Emails, phones, cards, IPs, IBANs, API keys and the US SSN are masked by default; open "Other countries' IDs" to add numbers such as Aadhaar, CPF or a Chinese ID card.
- Copy the masked text into your LLM chat or prompt. Read it through once: names, street addresses and free-form secrets are not detected.
- Paste the model's answer into the second box. Every tag the model kept is swapped back to the original value, ready to copy.
How it works
Each kind of data has its own rule. Emails use a standard address pattern. Card numbers are 13 to 19 digits that pass the Luhn checksum. IBANs must have the right length for their country and pass the mod-97 check. IPv4 needs four numbers from 0 to 255, IPv6 is checked group by group. Phone numbers are 9 to 15 digits with an international prefix or separators, plus Chinese mobiles (11 digits starting 13 to 19).
National IDs are checked with the issuing country's own algorithm where one exists: Korean RRN (date, sex digit and mod-11), Japanese My Number (mod-11), Chinese resident ID (ISO 7064 MOD 11-2, last character 0-9 or X, plus birth date), Indian Aadhaar (Verhoeff), Turkish T.C. Kimlik (two check digits), Brazilian CPF and CNPJ (two mod-11 digits each), Russian SNILS (mod-101) and INN (mod-11), Spanish DNI/NIE (mod-23 letter), French NIR (97 minus mod 97) and Saudi ID or Iqama (Luhn). Numbers without a check digit are tested for shape: India PAN (holder-type letter), Indonesian NIK and Malaysian MyKad (birth date and region code), Vietnamese CCCD (province code) and Pakistani CNIC (only in its dashed 5-7-1 form).
API keys are matched by known prefixes (sk-, AKIA, ghp_, xoxb-, AIza, Stripe sk_live_ and others, plus JWTs and private-key blocks), then filtered by Shannon entropy so a word like "sk-learn-docs" is left alone. Values after names such as password= or api_key= are masked, and long mixed-case strings with high entropy are flagged. When ranges overlap, the more specific rule wins, and the same value always gets the same tag.
The tag-to-value table lives only in this page's memory. Nothing is saved, sent or written into the address, and reloading or leaving the tab erases it. If you edit the original text after getting an answer, numbering can shift, so restore before editing.
FAQ
Is my text uploaded anywhere?
No. Detection and replacement run in your browser, and the tag table is never stored, not even in local storage or the URL. Reloading the page clears it, so keep the page open until you have restored the answer.
Which national ID numbers can it mask?
Korea RRN, US SSN, Japan My Number, China resident ID, India Aadhaar and PAN, Turkey T.C. Kimlik, Brazil CPF and CNPJ, Indonesia NIK, Russia SNILS and INN, Spain DNI/NIE, France NIR, Pakistan CNIC, Malaysia MyKad, Saudi ID/Iqama and Vietnam CCCD. Each language page turns on its own country's numbers; the rest are one tap away under "Other countries' IDs".
What will it miss?
Anything without a fixed shape: personal names, street addresses, company names, dates of birth, account numbers without a checksum, hex-only secrets, short passwords and secrets written in plain words. It can also flag look-alikes such as a 10-digit order number that happens to pass a check. Treat it as a safety net and read the result before you send it.
Why did the model change my tags?
Models sometimes drop the brackets, translate the tag or invent a new one. Tags that still match exactly are restored, and the tool lists the ones it could not find. Asking the model to "keep tags like [EMAIL_1] unchanged" helps.
Does masking make a prompt safe to share?
It lowers the risk but does not remove it. The surrounding text can still identify a person or a company, and a leaked secret should be rotated even if it was only pasted once. For regulated data, follow your own policy rather than relying on a pattern matcher.