Anonymize a CSV file

It parses your CSV into columns and classifies each one. A column is masked when its header names a PII category — email, phone, credit_card, ssn, first_name, address, date_of_birth, customer_id — or when a supermajority of its values match a tight shape: an email, an IP address, a phone number, a Luhn-valid card, a dashed SSN. The column-level gate is deliberate: one cell that looks like a phone number proves nothing, but a column that is 95% phone-shaped is a phone column. Every other column, free-text notes included, is still scanned cell by cell by the same engine that powers this site’s log file redactor, so an email or a password=… credential sitting in a comment is caught too.

Masked values become consistent placeholder tokens, and the same value always becomes the same token. A customer who appears in five rows is the same [ID-1] in all five; an email that shows up in an email column and again in a notes cell is the same [EMAIL-1] in both. That is what keeps the sample usable — joins, groupings, and counts survive, because referential integrity is preserved. This is tokenize-only by design: you get stable tokens, not fake-realistic lookalikes, because a fake name that reads as real is a liability, not a feature. The output is valid CSV with the same delimiter, the same columns in the same order, the same header text, and every byte outside a masked cell left exactly as it was.

The conceptual reference for a PII anonymizer is Microsoft Presidio, whose recognizer categories — person, email, phone, credit card, national id — shaped the vocabulary here. The honest difference: Presidio is a Python NLP library and service that reads free-running language to find a name in the middle of a sentence. This tool does column-level pattern matching in your browser, which is narrower on purpose. It is very good at “this whole column is phone numbers” and has no opinion about “the third word of this comment is a surname.” Naming that limit is the point — a tool that claimed to catch every name in every free-text field would be lying, and you would trust it exactly when you shouldn’t.

Detection is pattern-based and incomplete by construction. A PII column under a bland header (owner, contact, a vendor-specific name) with no tell-tale value shape is only masked if you flag it in the column table. A free-text field can hide a name or an address the scanner has no pattern for. Bare numeric ids are deliberately left alone — a 10-digit number is far more often an order id than a phone — so an identifier you consider sensitive may need a manual override. And the tool can over-mask: a column named city is treated as an address, and a review-flagged column defaults to masking, because masking too much is the safer failure. The column table and the side-by-side preview exist so the final human pass — the one no tool replaces — takes a minute, not an afternoon.

Reach for this page when the data is tabular — a CSV export where PII sits in columns. When it is nested — an API response, an export, a webhook payload — the JSON redactor walks the tree by key name and pattern instead. When it is free-running text — a log, a stack trace, a paste — the log file redactor scans it line by line. Same detection core, same trust story; different file shapes.

Files are processed entirely in this tab’s memory with a 20 MB ceiling. Scanning runs on the page’s main thread, so a large file can pause this tab for a few seconds — nothing is being uploaded during that pause; there is no network activity at all, which you can verify in DevTools. The page works offline once loaded, and nothing persists after the tab closes.