Free PII Scrubber: 22 Data Types, No Sign-Up

Free PII Scrubber: 22 Data Types, No Sign-Up

PII protection shouldn't cost anything. The PII Scrubber on this page is completely free, with no subscription, no account, and no trial period. It detects approximately 21 types of sensitive data and runs entirely in your browser, processing your text locally without transmitting it to any server.

Free browser-based tools for PII protection have historically been rare because the market assumed organizations would buy enterprise DLP software. Conversely, individual developers, freelancers, small teams, and compliance-conscious individuals need the same protection without the enterprise price tag. This tool provides it at zero cost, with no catch.

What the free scrubber includes

The free version includes every feature without restriction: detection of approximately 21 PII types covering emails, phone numbers, SSNs, IBANs, credit card numbers validated by the Luhn algorithm¹, IPv4 and IPv6 addresses, all major API key formats from AWS, GitHub, GitLab, Stripe, Google, SendGrid, Twilio, NPM, and Slack, plus JWT tokens, database connection strings, PEM private key blocks, and internal domain names. The two-way workflow supports both scrub and restore operations, the variables file downloads in JSON and CSV format for flexibility, and there is no input length cap on any paste. Consequently, there is no "Pro" version with additional detection types hidden behind a paywall, and all 21 types are available to every user at zero cost with no feature gates.

Why free and local together matter

Most free PII tools are free because they process your data on their servers, which their business model monetizes through analytics or data licensing. A tool that offers free processing with a server upload step does not actually protect your data; it just shifts who holds it from you to a third party with its own data retention policies. Building on this concern, the scrubber is both free and local, which is the combination that actually matters for data protection. CapyToolkit does not monetize user-submitted text because it never sees it. All processing happens in your browser using JavaScript, and the tool is supported by display advertising that does not require access to your input or any data about what you paste.

Limitations of a free browser-based tool

The scrubber works on text that you can paste from any source. It does not process binary files such as PDF, Word, or Excel documents natively, so you need to copy the text content from those files first before scrubbing. Furthermore, the detection patterns are regex-based, which means structured formats like SSNs with dashes and credit card numbers with spaces are reliably caught, but highly varied or custom credential formats that do not follow known patterns may require manual review. For enterprise-grade scanning of large document repositories with thousands of files, a dedicated DLP tool is more appropriate. Yet for the daily use case of scrubbing a prompt before pasting it to an AI tool, the free browser tool handles the vast majority of real-world scenarios with zero setup.

The two-step scrub-and-restore workflow in detail

The scrub step transforms your input text into tokenized output. Paste any text containing sensitive data into the Scrub tab and click Scrub. The tool replaces every detected sensitive value with a unique numbered token and presents both the scrubbed text and a downloadable variables file. The scrubbed text is safe to share with any AI tool or external system. The variables file is the key: it maps each token back to its original value and must be stored securely, separate from the scrubbed text.

The restore step reverses the process after the AI responds. Paste the AI's response (which contains tokens like [EMAIL_1] and [IP_1]) into the Restore tab. Upload the variables file downloaded after the initial scrub. Click Restore. Every token is replaced with the original value from the mapping, producing natural-language output with your real data restored. The restoration runs in your browser in under a second regardless of the response size, and the result is ready to copy without any server interaction at any stage of the workflow.

When to use JSON format versus CSV format for the variables file

The variables file is available in both JSON and CSV format. JSON format stores each mapping as an object with token, original value, and detected type fields, suitable for programmatic processing or import into a secrets management system. CSV format stores the same data in a flat table with columns for token and original value, suitable for opening in Excel or Google Sheets for manual review. For most manual scrub-and-restore workflows, the CSV format is easier to review at a glance. For integration with an automated restoration pipeline, JSON is more convenient because most programming languages parse JSON natively without a CSV parsing step.

Supported data types and how detection confidence varies

The scrubber uses pattern matching against 21 data type definitions to identify sensitive values in pasted text. Each pattern targets a specific format: email addresses use an RFC 5322 subset pattern², IPv4 addresses use a four-octet numeric pattern with range validation, and credit card numbers use a Luhn-valid digit sequence of 13 to 16 characters³. API key patterns are vendor-specific: AWS AKIA keys match the literal prefix followed by 16 uppercase alphanumeric characters⁴; GitHub tokens match ghp_ followed by 36 alphanumeric characters; JWT tokens match three base64url-encoded segments separated by dots with the first segment starting with eyJ⁵.

Detection confidence varies by data type. Email addresses have very high detection accuracy because the format is tightly constrained. SSN detection (three digits, dash, two digits, dash, four digits) is highly specific but misses SSNs presented without dashes. Internal hostname detection (domains ending in .corp, .internal, .local, .staging) has a higher false-positive risk in text that includes words ending in those strings as standalone tokens, which is why reviewing the variables file after each scrub matters most for hostname-heavy content.

Reviewing and correcting the variables file after scrubbing

After each scrub, audit the variables file for false positives before using the scrubbed text in production, and check for any expected sensitive values that are missing from the file (indicating a miss). For numeric fields that appear in the variables file unexpectedly, check whether the number satisfied the Luhn algorithm by matching a credit card pattern. Editing the variables file to remove an incorrect entry is safe: on restoration, tokens without a mapping in the file are left unchanged in the output, making them visible for manual correction rather than silently substituting wrong values.

Building a zero-cost PII governance workflow for small teams

Small teams with no dedicated compliance budget can build a complete PII governance workflow using only the free scrubber and a shared internal document. Create a one-page AI usage guide that lists the three most common scenarios where scrubbing is required (developer AI tools, customer data in support queries, HR data in administrative tools), links the scrubber URL, and describes the two-step workflow in plain language. Pin this document in your team's Slack channel or project management tool so it appears before employees begin any AI-assisted task involving personal data.

Designating one team member as the "PII point of contact" provides an escalation path when employees are uncertain whether a specific text requires scrubbing. The point of contact does not need compliance expertise: they need to know the policy (when to scrub), the tool (the scrubber URL), and who to ask if unsure. This structure maintains governance without requiring a dedicated compliance role or any budget for tooling.

Distributing the scrubber URL across the team without IT deployment

A shared browser bookmark folder exported as an HTML file and imported by each team member installs the scrubber URL in everyone's browser bar without requiring MDM or admin access. Chrome, Firefox, Edge, and Safari all support bookmark import from an HTML file via the browser's settings menu. Include the scrubber URL alongside other commonly used internal tools. Alternatively, add the URL to a team Notion page, shared bookmark manager, or internal tool directory so all team members discover it from the same starting point they use for other tools.

Because the tool is free and runs locally in the browser, sharing the URL costs nothing and adds no data transmission to any server. The variables file each team member downloads stays on their own device, and the same link works for developer prompts, customer data, and HR records without anyone needing an account or an IT provisioning step.

When to use this

Use this as your default pre-paste step whenever you work with text that might contain sensitive data and you need a free, no-signup tool that processes everything locally.

Examples

Client report for John Smith ([email protected], +1-415-555-0100). Invoice total: $12,500. Card: 4111111111111111.

Client report for John Smith ([EMAIL_1], [PHONE_1]). Invoice total: $12,500. Card: [CC_1].

AuthError: invalid token eyJhbGciOiJSUzI1NiJ9.eyJ1c2VyX2lkIjoiMTIzIn0.abc for user [email protected] from IP 192.168.5.1

AuthError: invalid token [JWT_1] for user [EMAIL_1] from IP [IP_1]