Security Runs locally Ready to use Built-in examples No tracking

Sensitive Data Masker

Mask ID cards, phone numbers, bank cards, emails, names and addresses with length-preserving asterisks.

Before a block of text goes into a group chat, a support ticket or a tutorial screenshot, the personal details in it should be masked: ID numbers, phone numbers, bank cards and email addresses. Masking here is length-preserving, so the asterisks occupy exactly as many characters as the original, which makes it easy to check which field was masked and gives away nothing beyond the length.

Two things that are easy to misremember. Masking is irreversible — there is no lookup table behind the asterisks — so make sure the original is no longer needed. And plain pattern matching cannot recognise a name or an address that carries no label, so those have to be added as custom keywords. This lowers the risk of a leak; it does not replace a data-handling process.

—

How to use

  1. Paste the text containing personal information.
  2. Choose the built-in patterns, or add custom keywords.
  3. Check which items were masked.
  4. Copy the masked text; the replacement cannot be undone.

How it works

What gets recognized

Six content types are recognized automatically: ID numbers (18-digit with a trailing X, plus legacy 15-digit), phone numbers (11 digits starting with 1), bank cards (15–19 digits; 18 starting with 62 treated as UnionPay), email addresses, and labeled names and addresses such as "Name:" or "Address:".

Masking rules

Masking is always equal-length: ID numbers keep the first 6 and last 4 digits, phones keep 3 + 4, bank cards keep 4 + 4, emails keep the first 2 characters and the full domain, names keep the family name (Zhang*, Wang**), addresses keep down to the district. Length is unchanged — easy to proofread against the original, and no extra information leaks beyond the visible digits.

Custom keywords take priority

Custom keywords run first with highest priority, ideal for client names, project codes and anything regex can't recognize. Keywords containing numbers (like internal ticket IDs) are replaced first too, so the automatic rules never process them again.

Code example

JavaScript Masking phone and ID numbers with regex 

// Same rule as this tool: replace in place, keeping the first 3 and last 4 (phone) / first 6 and last 4 (ID)
const mask = (s) => s
  .replace(/(1[3-9]\d)\d{4}(\d{4})/g, "$1****$2")      // phone
  .replace(/(\d{6})\d{8}(\d{3}[\dXx])/g, "$1********$2"); // 18-digit ID

mask("call 13812345678, ID 110101199003078515X");
// "call 138****5678, ID 110101********8515X"

Shell Locating the sensitive data in logs before masking 

# First list the phone numbers in the log (to decide what to mask)
grep -oE "1[3-9][0-9]{9}" app.log | sort -u

# Mask: keep the first 3 and last 4
sed -E "s/(1[3-9][0-9])[0-9]{4}([0-9]{4})/\1****\2/g" app.log > app-masked.log

# Note: for ID numbers, sed has to handle both the 15- and 18-digit lengths — grep first to confirm the format

FAQ

Can masked text be restored?

No. Asterisk replacement is irreversible, and the process keeps no mapping between original and mask, nor any copy of the original. Restorable concealment is encryption, not masking — and it means you hold a key.

Why are only labeled names like "Name: Zhang San" masked?

Chinese names have no fixed format — two to four characters can all form words — so a pure regex would misjudge ordinary words as names. Only labeled forms are masked, favoring accuracy; names in free text can be handled precisely via custom keywords.

Why does address masking keep the district?

Keeping the district makes records still comparable (which customer, which record) while removing street, house number and unit — the parts that locate a specific home. If even the district is sensitive, replace it wholesale via custom keywords.

Can a 15-digit ID be confused with a bank card?

They differ in length, so no. The real ambiguity is an 18-digit number — it could be an ID or a UnionPay card. This tool decides by prefix: 62 opening means bank card (keep 4 + 4); anything else is treated as an ID (keep 6 + 4). Both are fully masked either way, so security is unaffected.

Which wins — custom keywords or auto-recognition?

Custom keywords run first. Anything they cover never reaches auto-recognition, so the statistics count it once as "custom" without double counting; conversely, a keyword like a phone number won't be counted as a phone again.

Does masking substitute for data-compliance work?

No. Masking only reduces leak risk; it doesn't replace consent, data minimization, retention management or other compliance obligations. Before sharing or publishing data, do a manual review for indirect identifiers the tool can't see — order numbers, device IDs and the like.

Why is the mask the same length as the original?

Equal-length replacement makes character-by-character proofreading easy and preserves the text's parse structure. If even the length is sensitive, replace the whole passage as a custom keyword with a fixed number of asterisks.

Is the pasted text uploaded or saved?

No. Recognition and replacement are local regex operations — the text never crosses a server, enters no access log, and touches no browser storage. That's why this tool has no history section: close or refresh and the content is gone. Finish copying before you paste over it.