Free PII redactor

Paste text or drop a file to find and remove personal data: emails, phone numbers, credit cards, SSNs, IBANs, IP addresses, and API keys. The text is scanned on your device and never uploaded, which is the whole point of redacting it in the first place.

How the PII redactor works

Paste text or drop a file

A .txt, .csv, or .json file is read with the browser's FileReader API. It is opened on your machine, not uploaded to ours.

Choose what to catch

Each type has a toggle. Card numbers are checked with the Luhn algorithm and IBANs with the mod-97 checksum, so ordinary long numbers are left alone.

Copy or download the result

Mask the value, keep a fragment of it, or swap it for a stable token. Then copy the text or save it as a file. Nothing leaves your device.

Private by design: nothing leaves your browser

Text that needs redacting is, by definition, text that should not be handed to a stranger's server. Uploading a customer transcript to an online redaction service to make it safe to share has already shared it. This tool is built so that trade never comes up:

100% client-side

Matching is JavaScript regular expressions running in your tab, and files are read with FileReader. The page makes no request with your text in it, so there is nothing on a server to breach or subpoena.

Nothing stored or logged

There is no account and no analytics on what you paste. The text, the detections, and the pseudonym mapping live in memory and are gone when you reload.

Checksums, not guesses

Candidate card numbers must pass the Luhn check and IBANs the ISO 13616 mod-97 check before anything is touched, so a 16-digit order reference is not shredded along with the real data.

What this does not claim

Pattern matching finds structured identifiers. It does not understand your text, so a name, an employer, or a rare medical detail written in prose will pass straight through.
This is not GDPR anonymisation and it is not HIPAA Safe Harbor de-identification. Both have requirements a regex pass does not meet.
Treat the output as reduced exposure, not as proof of compliance. Review it before you send it anywhere.

Built for developers and privacy-conscious teams

Anyone who has to share text that carries data it should not carry. BlockSurvey takes the same position on research data with zero-knowledge surveys, where responses are encrypted before they ever reach a server.

Developers

Scrub a production log or a stack trace before pasting it into a ticket, a chat, or a model prompt, and catch the API key someone left in it.

Support & ops teams

Strip card numbers and addresses out of a customer transcript before it goes to a vendor, and keep the ticket readable while you do it.

Researchers & analysts

Swap identifiers for stable tokens so open-ended responses can still be grouped and counted per person without the person being in the file.

Building something that handles sensitive data?

BlockSurvey runs on zero-knowledge surveys, so the responses you collect are never sold or mined. Responses are encrypted on the respondent's device, so the server stores nothing readable.

More free privacy tools

Browse all privacy tools

Secure password generator

Generate a strong random password, passphrase, or PIN in your browser with the Web Crypto API.

Encryption key generator

Generate AES-128, AES-192, and AES-256 keys or random secrets, entirely in your browser.

Encryption and decryption tool

Encrypt or decrypt text with AES-256-GCM. The message and passphrase never leave your browser.

Password strength checker

Check a password's real strength and entropy in bits, scored on your device and never sent anywhere.

PGP encryption tool

Encrypt, decrypt, and generate PGP keys. Keys and messages never leave your browser.

Hash generator

Generate MD5, SHA-256, HMAC, and bcrypt hashes, computed entirely on your device.

UUID generator

Generate UUID v4, v7, v1, or a GUID, one or a thousand at a time, entirely in your browser.

JWT decoder

Decode a JSON Web Token and verify its signature in your browser. The token and key never leave your device.

TOTP generator

Generate a live 6-digit 2FA code from a base32 secret, or create a secret to scan into your authenticator app.

CSP generator

Build a Content-Security-Policy header, then check an existing one for unsafe-inline and wildcards.

Base64 encoder and decoder

Encode text to Base64 and decode it back to text or a file, with URL-safe and MIME options.

URL encoder and decoder

Percent-encode and decode URLs, and split any URL into its decoded query parameters.

Hex converter

Convert between text, hex, binary, decimal, ASCII, and Base64 in any direction, with a live byte table.

Answer a short form and get a GDPR and CCPA privacy policy as HTML, Word, or PDF.

Terms and conditions generator

Draft terms for a website, app, store, or SaaS and download them as HTML, Word, or PDF.

Cookie policy generator

Build a cookie policy with a real cookie table covering name, provider, purpose, type, and duration.

Disclaimer and EULA generator

Pick the clauses you need, from affiliate disclosure to warranty and liability, and export the document.

Secure QR code generator

Generate a QR code entirely in your browser. The link goes straight to your destination, not through a tracking redirect.

Email bounce checker

Check a list of email addresses for bounces and bring your bounce rate down before you send.

Image compression

Compress images in the browser to cut file size while keeping the quality you need.

These tools run in your browser because that is how we build everything. The same idea, applied to research: privacy-first surveys with end-to-end encryption.

Frequently asked questions

Is this PII redactor free?

Yes, completely free, with no sign-up and no cap on how many times you can run it. The only limit is 200,000 characters per pass, which is there to keep the page responsive.

Does the text I paste get sent to a server?

No. The text stays in the browser tab. Detection is regular-expression matching in JavaScript, redaction is string replacement, and files are read with the browser's FileReader API, so the contents never travel over the network. There is no upload, no request, and nothing for us to log or keep. Close the tab and the text is gone.

What counts as PII here, and what does the tool detect?

It detects structured identifiers that follow a predictable shape: email addresses, phone numbers, credit card numbers, US Social Security numbers, IBANs, IPv4 and IPv6 addresses, API keys and bearer tokens, street addresses, dates, and passport-style IDs. Each type has its own toggle, so you can redact only what you care about.

Will it catch every piece of personal data in my text?

No, and you should not treat it as if it does. Regex detection finds identifiers with a recognisable structure. It will miss free-text personal information that has no fixed shape, such as a person's name, a job title next to an employer, a rare medical detail, or an identifier written in an unusual way. Read the highlighted preview and check the result before you share it.

Does this make my data anonymous under GDPR or HIPAA?

No. Redacting identifiers reduces exposure, but it is not the same as anonymisation under GDPR or de-identification under the HIPAA Safe Harbor method, both of which have specific requirements this tool does not attempt to meet. Use it to strip obvious identifiers before sharing a log, a transcript, or a support ticket. Do not use it as your compliance control.

How does it avoid flagging random numbers as credit cards?

Every candidate card number is run through the Luhn algorithm, the checksum that real card numbers satisfy. A 16-digit order reference will almost always fail it and be left alone. IBANs get the same treatment with the ISO 13616 mod-97 check, so only numbers with a valid checksum are redacted.

What is the difference between the three redaction styles?

Block mask replaces the whole value with a label such as [EMAIL], which is the safest option. Partial mask keeps a fragment for reference, such as the last four digits of a card, so a human can still recognise a record. Pseudonym replaces each unique value with a stable token such as EMAIL_1, so the same address is always the same token and the text stays analysable without exposing the value.

Is the pseudonym mapping reversible?

Only by you, and only while the tab is open. The mapping table lives in memory in your browser, is never written to disk or sent anywhere, and disappears on reload. If you need to reverse the tokens later, copy the table out yourself and store it somewhere you control. Anyone holding just the redacted text cannot recover the originals from it.

Can I use this offline?

Yes. Once the page has loaded you can disconnect from the internet and keep redacting, because every part of it runs in your browser.

Do you store the text I paste in?

No. Detection and redaction both run in your browser, so the text you paste, and the pseudonym mapping built from it, are never sent to or kept on a server. Both disappear when you reload the page.

How is this different from a paid PII redaction tool?

Paid redaction tools, and some free ones, typically send your text to a server or an AI API to find the sensitive spans. This one detects and redacts entirely client-side with pattern matching, so text that may contain private data never leaves your browser, and there is no sign-up or usage cap.