Quick Answer
PII redaction finds and removes personally identifiable information — emails, phone numbers, SSNs, card and bank numbers, IP addresses, API keys, and street addresses — from text before you share it. Paste text into this free tool and it highlights every match instantly, then masks partial values (j***@e***.com), replaces them with [EMAIL]-style labels, or swaps them for {{EMAIL_1}} placeholders with a reversible mapping you can export as JSON. Everything runs in your browser, so nothing is uploaded and no account is needed.
How It Works
Paste the text to scrub (or click Load sample for a fictional support ticket containing every PII type) — detection runs instantly as you type and nothing leaves this browser tab
Review the highlights: each finding is underlined by type in the original text, with counts in the legend; toggle any detector off or add a custom regex for project-specific IDs
Pick an output mode: Mask keeps a readable fragment like j***@e***.com, Redact swaps in [EMAIL]-style labels, or Pseudonymize replaces values with {{EMAIL_1}} placeholders
Copy the cleaned text or download it as a .txt file; in Pseudonymize mode, copy the reversible mapping as JSON so the substitution can be undone later
Key Facts
- Nine detector types: email, phone (US + international E.164), SSN, credit card, IBAN, IPv4, API keys and tokens (OpenAI, AWS, GitHub, Slack, Google, JWT), US street addresses, plus your own regex patterns
- Credit-card candidates must pass the Luhn checksum and IBANs the ISO mod-97 check, so look-alike digit runs (timestamps, order IDs) are not flagged
- Three output modes: Mask keeps a readable fragment, Redact swaps in [EMAIL]-style labels, Pseudonymize uses {{EMAIL_1}} placeholders
- Pseudonymize mode builds a reversible mapping table that copies or exports as JSON
- The original text stays visible with per-type colored underlines and a legend, so every detection can be verified before you copy
- Custom patterns accept any JavaScript regex with a label; invalid syntax is flagged inline without breaking other detectors
- Zero network calls — detection runs entirely in this browser tab and pasted text never leaves your device
- Free with no account, no limits, and no watermark, plus a one-click synthetic sample
Frequently Asked Questions
How does the detector decide what counts as PII?
Each type has a deterministic rule with a validation gate. Credit-card candidates are 13–19 digit runs or grouped 4s that must pass the Luhn checksum — a 16-digit order number that fails Luhn is not flagged, and brands (Visa, Mastercard, Amex) are read from the prefix and length. IBANs must start with a country code from the IBAN registry and pass the ISO 13616 mod-97 check. IPv4 octets must each fall in 0–255. Phone and SSN patterns use boundary checks so digits inside longer runs (timestamps, account IDs) are ignored. When two candidates overlap, the earliest match wins and the longest match wins at the same position — so a full card number hides any phone-shaped span inside it.
Is my text private in this tool?
Yes. The tool makes zero network calls — detection and redaction run entirely in this browser tab, so pasted text never leaves your device. You can verify this in your browser DevTools Network tab while typing. The text itself is never saved; only your detector toggles and custom patterns are kept in localStorage so the tool remembers your setup. Clearing the text box removes it completely.
Is it free, and how does it compare to paid PII tools?
Completely free and unlimited — no account, trial, or watermark. Cloud NLP services charge per character for PII detection (for example, Amazon Comprehend lists PII entity detection at $0.0001 per 100 characters after its monthly free tier). Open-source Presidio is free but requires a Python environment and configuration. This tool runs deterministically in the tab at no cost, which also makes it faster for everyday paste-and-scrub jobs — no queueing, no API keys.
What is the difference between Mask, Redact, and Pseudonymize?
Mask keeps a readable fragment so the text stays useful: [email protected] becomes j***@e***.com and 4242 4242 4242 4242 becomes **** **** **** 4242. Redact removes the value entirely and replaces it with a type label like [EMAIL] or [CARD], which is best for sharing logs or support tickets. Pseudonymize replaces each value with a stable placeholder like {{EMAIL_1}} and shows a mapping table — useful for prompts, datasets, and debugging output where you may need to reverse the substitution later. Mask and Redact are one-way; only Pseudonymize is reversible.
Can I add my own patterns, like employee or order IDs?
Yes. Add a label and any JavaScript-flavored regular expression (the global flag is applied automatically, for example \bORD-\d{6}\b with the label Order ID). Matches are highlighted, redacted as [CUSTOM:Order ID], and pseudonymized as {{CUSTOM_ORDER_ID_1}}. Invalid regex syntax shows an inline error explaining the problem without affecting the built-in detectors or other custom patterns.
Is the pseudonymized text reversible, and how do I restore it?
Yes. Each unique value gets a stable placeholder (the same email always becomes the same {{EMAIL_1}}), and the mapping table lists every placeholder with its original value. Copy the mapping as JSON and keep it with the redacted file — substituting each placeholder back with its original restores the text exactly. Treat the mapping as sensitive: it contains the PII you removed.