PII Redactor

this.flags[kind]); enabled.forEach(([kind, pattern]) => { for (const match of this.text.matchAll(pattern)) { this.matches.push({ kind, value: match[0] }); } }); this.result = enabled.reduce( (value, [, pattern]) => value.replace(pattern, () => this.replacement), this.text, ); }, read() { try { return JSON.parse(sessionStorage.getItem(this.storageKey) || '{}'); } catch (e) { return {}; } }, restore() { if (!this.funnel) return; const state = this.read(); if (typeof state.text === 'string') this.text = state.text; if (typeof state.replacement === 'string') this.replacement = state.replacement; Object.keys(this.flags).forEach((kind) => { if (state.flags && state.flags[kind] !== undefined) this.flags[kind] = !!state.flags[kind]; }); }, save() { if (!this.funnel) return; try { sessionStorage.setItem(this.storageKey, JSON.stringify({ text: this.text, replacement: this.replacement, flags: this.flags, })); } catch (e) {} }, go(url) { this.save(); window.location.assign(url); }, reset(url) { try { sessionStorage.removeItem(this.storageKey); } catch (e) {} window.location.assign(url); }, init() { this.restore(); if (this.funnel && this.step > 1) this.process(); }, }" >
Next

Find and replace common sensitive-data patterns before sharing text. The browser-based detector covers email addresses, loosely formatted phone numbers, US-style Social Security numbers, 16-digit card-number shapes, dotted IPv4 shapes and, when enabled, HTTP(S) URLs. Choose the categories and replacement text, then review both the matches and redacted output. Regular expressions can miss unusual forms and flag harmless text, so this is a review aid rather than a guarantee of anonymisation.

How to redact common PII patterns

  1. 1

    Paste the text

    The text remains in Alpine browser state; in the three-step flow it is carried between pages in sessionStorage.

  2. 2

    Choose detectors

    Email, phone, US SSN, card and IPv4 are on by default; HTTP(S) URL detection is off by default.

  3. 3

    Set the replacement

    Use `[REDACTED]`, another literal marker or an empty value to remove each detected string.

  4. 4

    Redact and review

    Inspect the matches and the output for false positives and anything the patterns missed before sharing it.

What each detector actually matches

Detector Example Exact behavior
Email name@example.com ASCII-style local/domain characters and a letter-only final suffix of at least two characters
Phone +1 (555) 123-4567 Loose groups of digits with optional country code, parentheses, spaces or hyphens
US SSN 123-45-6789 Exactly the 3-2-4 digit shape; it does not validate whether an SSN was issued
Card 4111 1111 1111 1111 Exactly four groups of four digits with optional spaces or hyphens; no Luhn or issuer check
IPv4 192.168.1.10 Four dot-separated groups of one to three digits; it does not enforce the 0–255 range
URL https://example.com/path Text beginning with http:// or https:// up to whitespace or selected punctuation; off by default

The matches list is built from the original text. A string can therefore appear under more than one enabled detector. The interface shows at most the first 30 match badges, although the total count covers every match. Replacement then runs by detector order, email, phone, SSN, card, IPv4 and URL, and inserts the replacement as literal text.

False positives and false negatives

  • The loose phone expression can flag order numbers, dates or other grouped digits.
  • The card expression can flag any matching 16-digit identifier and misses card formats outside its exact shape.
  • The IPv4 expression accepts impossible values such as 999.999.999.999.
  • Obfuscated emails, phone numbers written in words, extensions and national identity formats other than the US SSN shape may be missed.
  • URLs without http:// or https:// are not detected, and URL detection is disabled initially.
  • Names, postal addresses, dates of birth, account names and free-text clues are not detected.

Always read the output. For regulated or high-risk data, use a reviewed anonymisation process with appropriate validation, access controls and expert oversight.

Browser-only processing boundary

Detection and replacement run in Alpine in your browser. The source text, matches, replacement and output are not server-side properties and are not sent to the application server or placed in a URL. The normal interface keeps them in page memory. The three-step flow uses browser sessionStorage so the state survives its page changes; Start over clears that entry. Copying the result uses the browser clipboard API.

Frequently Asked Questions

No. It is a regex-based review aid, not a complete anonymisation or compliance process. Use documented controls, validation and qualified privacy or legal review where required.

No. It detects only the listed text shapes. Unusual or obfuscated forms can be missed, while harmless values with the same shape can be flagged. Always review both matches and output.

Every detected string is replaced with the exact text you enter. The default is [REDACTED]; symbols such as $ are treated literally, and an empty replacement removes the match.

No. Processing runs in Alpine in your browser. The normal view keeps state in page memory, while the three-step flow keeps it in browser sessionStorage; no source text, match or output is a server-side property or URL parameter.

Related Tools

Tool available in other languages