Free PII redactor

Frequently Asked Questions

01Is this PII redactor free?

Yes, completely free, with no sign-up and no cap on how many times you can run it. The only limit is 200,000 characters per pass, which is there to keep the page responsive.

02Does the text I paste get sent to a server?

No. The text stays in the browser tab. Detection is regular-expression matching in JavaScript, redaction is string replacement, and files are read with the browser's FileReader API, so the contents never travel over the network. There is no upload, no request, and nothing for us to log or keep. Close the tab and the text is gone.

03What counts as PII here, and what does the tool detect?

It detects structured identifiers that follow a predictable shape: email addresses, phone numbers, credit card numbers, US Social Security numbers, IBANs, IPv4 and IPv6 addresses, API keys and bearer tokens, street addresses, dates, and passport-style IDs. Each type has its own toggle, so you can redact only what you care about.

04Will it catch every piece of personal data in my text?

No, and you should not treat it as if it does. Regex detection finds identifiers with a recognisable structure. It will miss free-text personal information that has no fixed shape, such as a person's name, a job title next to an employer, a rare medical detail, or an identifier written in an unusual way. Read the highlighted preview and check the result before you share it.

05Does this make my data anonymous under GDPR or HIPAA?

No. Redacting identifiers reduces exposure, but it is not the same as anonymisation under GDPR or de-identification under the HIPAA Safe Harbor method, both of which have specific requirements this tool does not attempt to meet. Use it to strip obvious identifiers before sharing a log, a transcript, or a support ticket. Do not use it as your compliance control.

06How does it avoid flagging random numbers as credit cards?

Every candidate card number is run through the Luhn algorithm, the checksum that real card numbers satisfy. A 16-digit order reference will almost always fail it and be left alone. IBANs get the same treatment with the ISO 13616 mod-97 check, so only numbers with a valid checksum are redacted.

07What is the difference between the three redaction styles?

Block mask replaces the whole value with a label such as [EMAIL], which is the safest option. Partial mask keeps a fragment for reference, such as the last four digits of a card, so a human can still recognise a record. Pseudonym replaces each unique value with a stable token such as EMAIL_1, so the same address is always the same token and the text stays analysable without exposing the value.

08Is the pseudonym mapping reversible?

Only by you, and only while the tab is open. The mapping table lives in memory in your browser, is never written to disk or sent anywhere, and disappears on reload. If you need to reverse the tokens later, copy the table out yourself and store it somewhere you control. Anyone holding just the redacted text cannot recover the originals from it.

09Can I use this offline?

Yes. Once the page has loaded you can disconnect from the internet and keep redacting, because every part of it runs in your browser.

10Do you store the text I paste in?

No. Detection and redaction both run in your browser, so the text you paste, and the pseudonym mapping built from it, are never sent to or kept on a server. Both disappear when you reload the page.

11How is this different from a paid PII redaction tool?

Paid redaction tools, and some free ones, typically send your text to a server or an AI API to find the sensitive spans. This one detects and redacts entirely client-side with pattern matching, so text that may contain private data never leaves your browser, and there is no sign-up or usage cap.