PII Redactor: Clean Text Before Pasting into AI
Paste text and redact emails, phone numbers, IPs, IBANs, card numbers, and API keys before sending it to ChatGPT or Claude. Nothing leaves your browser.
Overview
A PII redactor scans pasted text in your browser for emails, phone numbers, IP addresses, IBANs, Luhn-valid card numbers, API keys, and secret URL tokens, then swaps each one for a numbered placeholder like [EMAIL_1] before you paste the text into ChatGPT, Claude, or any other AI tool. Detection runs entirely locally: nothing you paste is uploaded, logged, or sent anywhere. A restore map lets you recover the originals afterward.
How it works
- 1Paste the text you're about to send to an AI chatbot into the box.
- 2Review the live redacted output; each match is swapped for a bracketed placeholder like [EMAIL_1] or [PHONE_1].
- 3Add any names, aliases, or company names it should also scrub in the custom names field, comma-separated.
- 4Toggle a detection kind off in the chip row if you want to keep something in place, for example a public IP address.
- 5Copy the redacted text and paste that into your AI tool instead of the original.
- 6Open the restore map afterward to see or copy the original values if you need to reverse the redaction later.
Worked example
A support message before it goes into ChatGPT
Input: "Hi team, my number is +1 (415) 555-0132 and my email is jane@example.com. Server IP for the staging box is 192.168.1.42. Refund IBAN: DE89370400440532013000. Please dont forward the API key sk-ant-api03-REDACT-ME-1234567890abcdef, and drop the tracking link https://app.example.com/share?token=abc123XYZ from the ticket before you paste this into ChatGPT." The tool finds 6 matches, one of each kind, and outputs: "Hi team, my number is [PHONE_1] and my email is [EMAIL_1]. Server IP for the staging box is [IP_1]. Refund IBAN: [IBAN_1]. Please dont forward the API key [APIKEY_1], and drop the tracking link https://app.example.com/share?token=[TOKEN_1] from the ticket before you paste this into ChatGPT." The restore map records all 6 originals, so the redaction can be reversed later.
Methodology & privacy
Detection is pattern-based, not machine learning: each kind has its own regular expression, and two kinds add a checksum so the match has to be structurally valid, not just shaped right. Card numbers (13 to 19 digits) must pass the Luhn checksum from ISO/IEC 7812-1, so a random 16-digit number is left alone while a real card number is caught. IBANs (two letters, two check digits, then up to 30 alphanumeric characters) must pass the ISO 13616 check: move the first four characters to the end, convert each letter to a two-digit number (A=10 through Z=35), and require the result to be congruent to 1 modulo 97. Phone numbers require either an international prefix (+ or 00) or at least 9 digits with separators, specifically to avoid flagging years, IDs, or short reference numbers as phone numbers. Email, IP address, API key prefix (sk-, sk-ant-, ghp_, gho_, xoxb-, AKIA, AIza, PEM blocks), and secret-URL query parameter (token=, key=, secret=) each have a dedicated pattern; only the parameter's value is redacted, not the whole link. Custom names are matched case-insensitively as whole words. When two matches overlap, the longest one wins. Every distinct value is assigned one placeholder number per kind, in the order it first appears, so repeats of the same email or number reuse the same placeholder.
- Source: Quora: Can the AI Chatbot handle sensitive or confidential information?
- Source: Quora: What are the implications of ChatGPT revealing personal user data with just a simple prompt?
- Source: Stanford HAI: Be Careful What You Tell Your AI Chatbot
- Source: Wikipedia: International Bank Account Number (mod-97 check digit algorithm, ISO 13616 / ISO-IEC 7064)
Everything runs in your browser's JavaScript engine. The text you paste, the custom names you add, and the redacted output never leave your device: there is no server call and nothing is logged, stored, or sent anywhere.
FAQ
Can the AI Chatbot handle sensitive or confidential information?
+
Most consumer AI chatbots log prompts server-side by default and may use them for review or training unless you opt out, so treat anything you paste as potentially retained. Redacting identifiers, contact details, and secrets before pasting is the safest default.
What are the implications of ChatGPT revealing personal user data with just a simple prompt, and what measures should be taken to address potential privacy concerns?
+
If personal data goes into a prompt, it can be stored, reviewed by humans, or resurface in later answers depending on the provider's retention and training settings. Stripping emails, phone numbers, IDs, and secrets before pasting removes that risk at the source, rather than relying on the provider's privacy settings.
Does this catch every name and address, not just emails and phone numbers?
+
No. Detection here is regex and checksum based, so it reliably catches structured identifiers like emails, phone numbers, IPs, IBANs, card numbers, and API keys, but it cannot recognize a free-text name or street address on its own. Add any names it should also catch to the custom names field.
How does the tool know a 16-digit number is a real credit card and not a random ID?
+
It runs the Luhn checksum (ISO/IEC 7812-1) that card networks use to validate card numbers. A random 13 to 19 digit number that fails the checksum is left alone; only digit sequences that actually pass it are flagged as a card.
Is my text actually private, or does it get uploaded anywhere?
+
It stays private. Detection and redaction both run in your browser's JavaScript; the tool never makes a network request with your text, so nothing you paste is uploaded, logged, or visible to anyone else.
Can I undo the redaction and get my original text back?
+
Yes. Every redaction keeps a restore map of placeholder to original value, shown in a collapsible panel you can copy. Feed that map back alongside the redacted text later to reconstruct the original.
Why didn't it redact a phone number I pasted?
+
Phone detection requires either a leading + or 00 country-code prefix, or at least 9 digits total, so short local numbers, years, and reference IDs without a country code aren't mistaken for phone numbers. If your number is short and unprefixed, add it to the custom names field instead.
Related tools
Token Counter & Context-Window Fit (with boundary view)
Paste text for an exact GPT-4o/GPT-4 token count, rough Claude, Llama 3, and Gemma estimates, and a colored boundary view. Nothing you type leaves your browser.
Local vs Cloud LLM Break-Even Calculator
Calculate whether a local LLM or a cloud API costs less per 1M tokens, including amortized hardware, power, and the break-even point.
Can Your Mac Run It? LLM RAM Calculator
Check whether a model and quant will fit your Mac unified memory or GPU VRAM, with KV cache math, a max context solver, and a tokens per second estimate.
ChatGPT/Claude Export to Markdown
Drop ChatGPT's conversations.json or a Claude export and get one clean Markdown file per conversation, code blocks intact, nothing uploaded.
This tool fixes one moment. recal handles the whole day.
recal is a private brain for your Mac. It watches how you work, on device, and starts doing your busywork itself. You approve every action.
Get early access