What Is PII?

Personally Identifiable Information (PII) is any data that could be used on its own or with other data to identify a specific person. Common examples include names, email addresses, phone numbers, Social Security numbers, credit card numbers, and IP addresses.

Why Redact PII?

Before sharing logs, support tickets, exported documents, or datasets with third parties, it is important to remove or mask PII to protect privacy and comply with regulations like GDPR and HIPAA. This tool makes that process fast and entirely client-side; your text never leaves your browser.

Replacement Styles

Block replaces each character with a filled block (█), preserving the original length. [REDACTED] replaces the entire match with a uniform label. Partial keeps the first and last character while masking the middle: useful when you need to hint at the value without revealing it. Hash prefix replaces each match with a short SHA-1 digest prefix, allowing you to detect the same value appearing multiple times without revealing what it is.

Custom Rules

Add your own regular expressions to catch patterns specific to your data, such as employee IDs, internal reference numbers, custom account formats, and so on. Custom rules are applied on top of the built-in patterns.

Automatic pattern library

The built-in pattern library covers the most common PII and sensitive data patterns:

Email addresses: based on RFC 5321 format detection.
US phone numbers: NANP format including area code variations with parentheses, dashes, dots, or spaces.
US Social Security Numbers (SSN): 9-digit numbers in XXX-XX-XXXX format.
Credit card numbers: 13–16 digit sequences matching Luhn algorithm validity (Visa, Mastercard, Amex, Discover).
US ZIP codes: 5-digit and ZIP+4 format.
IPv4 and IPv6 addresses: complete IP address patterns.

Redaction vs. anonymization

These terms are often used interchangeably but represent different things in data privacy:

Redaction removes or replaces specific identifiers (name, email, SSN) but leaves the surrounding context intact. The document may still allow re-identification if enough contextual clues remain.
Anonymization transforms data so that re-identification is impossible even with additional data sources. It requires techniques like k-anonymity, l-diversity, or differential privacy.

Under the GDPR, only true anonymization removes personal data from scope. Redacted documents that can still be linked to an individual are considered pseudonymized, not anonymized, and are still subject to GDPR requirements.

Audit trail note

In regulated industries (healthcare, legal, finance), redaction workflows must maintain an audit trail: which rules were applied, when, and by whom. This tool is designed for quick manual redaction and does not produce an audit log. For compliance use cases requiring traceable redaction (e.g., HIPAA Business Associate Agreements, legal discovery), use certified document redaction software that maintains a full audit trail.