Nothing leaves the page
This matters more here than on any other tool on the site, so it goes first. The matching and the substitution are plain JavaScript running in your browser. There is no upload, no request to a server, no logging, and no storage — close the tab and the text is gone. That is the whole reason a redaction tool should be client-side: the alternative is transmitting the exact text you were trying not to share in order to have it scrubbed. You can verify it by opening your browser's network panel and watching nothing happen while you type, or by disconnecting from the network and using the page anyway.
The three masking levels
Partial keeps the parts people use to identify a record — the last four digits, the domain, the street name — and stars the rest. Use it when colleagues still need to say "the 555-***-2378 case" to each other. It is the weakest setting: a partial value plus one other dataset often narrows to a single person, so it is for internal working documents, not for anything leaving the building.
Full replaces the whole value. Nothing survives, including the ability to tell two different phone numbers apart.
The typed token sits in between. The same input always produces the same tag, so [PHONE#3f9a] appearing twice tells you the same number appeared twice, without revealing it. That is useful for counting distinct people in a log. Two cautions: the tag is only four hex digits, so distinct values will occasionally collide, and the hash is a plain non-cryptographic one over a small space — anyone with the tag and a list of candidate phone numbers can find the match by trying them all. Treat tokens as a grouping aid, never as a secret.
Order of operations
Emails go first, because the digits inside an address would otherwise be claimed by the numeric rules. Then the fixed-length shapes, SSN and card, because they are the most specific. IPv4 runs before phone numbers so a dotted quad is not read as a dot-separated phone number. Street addresses come near the end, and the name list last. Each match is swapped for a placeholder immediately and only restored at the very end, so no later rule can chew on an already-masked value. This ordering is doing real work — reverse two of these rules and you get card numbers sliced into fragments by the phone rule.
Why names are a list you type
Every other rule here matches a shape. Names have no shape. There is no arrangement of letters that distinguishes a surname from an ordinary noun, and any dictionary-based guess fails in both directions at once: common names collide with common words and produce a flood of false matches, while unusual names are absent from the dictionary and slip through. So this tool changes only the exact strings you supply. Copy the name column out of your source table, paste it in comma-separated, and remember that it matches literally — a person recorded as "Robert Chen" in one line and "Bob Chen" or "R. Chen" in another needs all three listed.
What redaction of this kind cannot reach
It reads characters in a text box. It does not see text inside images or scanned PDFs, metadata in file properties, tracked changes, or anything in a document you have not pasted here. Beyond format, it cannot reason: a record scrubbed of every direct identifier can still be one person if the remaining details are specific enough, and no pattern matcher will flag that. Treat the output as a draft that removed the tedious 90%, then read it yourself before it goes out, and check the applicable rules if a formal de-identification standard is in play.
Questions people ask
Is the text sent anywhere?
No. All the matching and replacement happens in your browser and nothing is transmitted or stored. You can confirm it by watching the network panel while the tool runs, or by going offline and using it anyway. That covers the technical side; if your workplace has a policy about where certain documents may be opened at all, that policy still applies to a browser tab regardless of where the processing occurs.
Can the original values be recovered from the output?
Not from stars — those characters are simply gone. Partial masking is different: what it keeps can often be combined with another dataset to narrow the original down, which is exactly why it is labelled as the internal-use option. Typed tokens do not embed the value, but the input space for something like a phone number is small enough to exhaust by brute force, so they are not a confidentiality mechanism either. Full masking is the only setting with nothing left to work from.
Why did it mask an order number and miss a ZIP code?
Both come from the same limitation. The card rule looks for sixteen digits in a familiar grouping and does no validation, so any sixteen-digit reference matches. A ZIP is five digits, which is indistinguishable from a quantity, a year range, an ID, or a page count — a rule for it would mask far more good data than bad. Switch off the pattern types you do not need, and handle specific known strings with the name list or with a find-and-replace.
Does it handle international phone numbers?
Only North American ten-digit numbers, with or without a leading 1. A number in E.164 form or with a non-US country code will not match, and neither will one with an extension appended. If your data is international, add the specific numbers to the name box — it matches any literal string, not just names — or write a pattern in the regex tester first and confirm it does what you expect on a sample.
How much text can it take at once?
200,000 characters, roughly 30,000 words. Above that the input is truncated and the tool says so rather than locking up the tab. For a bigger corpus, split it into chunks and run each separately; the typed-token setting produces the same tag for the same value across separate runs, so tokens stay consistent between chunks.