Mask Personal Data in a CSV
- No Sign-up
- 100% Free
- Zero Server Data
Somebody in HR has to send a staff list to an insurer, or a customer export to an agency, and the file has ID numbers and phone numbers in it that must not go. Doing it by hand takes an afternoon and misses a row. Doing it on an ordinary website means the file was uploaded to somebody else, which is the thing the law you are worried about was written to prevent. This reads the file in your browser, shows you what it found column by column, and covers up only the columns you pick. The spreadsheet never leaves your machine.
1 · Your spreadsheet
2 · What was found
Every column is listed with what it appears to contain. Tick the ones to cover up. Nothing is changed until you press the button.
3 · How to cover it
Pick one. What it does to a value is described below.
4 · The result
Add a spreadsheet to begin.
This finds patterns. Names, addresses and free-text notes are personal data too and look like ordinary writing, so no pattern will catch them. Read the file before you send it.
Frequently asked questions
Is my spreadsheet uploaded anywhere?
No, and that is the entire reason this exists. Your browser reads the file, finds the patterns and writes a new one, all in the tab. The site’s security policy sets connect-src ‘none’, so the browser blocks network requests from these pages. A tool that asks you to upload a file full of customer records in order to remove the customer records has not solved the problem you have.
How does it know which column is which?
By pattern, and by checking the patterns rather than trusting them. A Thai national ID has to satisfy its checksum, a card number has to satisfy Luhn, and a phone number has to look like a phone rather than like a price. Thirteen digits alone is not an ID, because order numbers and timestamps are thirteen digits too, and a tool that masked those would destroy the file you were trying to send.
What will it miss?
Names, addresses, dates of birth, job titles, medical notes and anything else written as ordinary text. Those are personal data and no pattern finds them, so the page says so instead of implying a clean sweep. You can still tick those columns yourself; the difference is that we will not pretend to have found them for you.
Which should I choose, stars or a code?
Stars if the recipient only needs to see that a value was there. A code if they still have to count or join on it: masking turns ann@ and amy@ into the same string, and a row count over that column stops meaning anything. The code is stable, so the same address is always the same code within one file.
Is the code secure?
No, and it would be dishonest to imply it. A phone number has about ten digits of possibilities and anyone can work through all of them in a second, so a determined person can reverse it. It defeats reading, not attacking. If the data must be genuinely unrecoverable, empty the cell.
Does it work with Thai?
Yes, including files Excel currently opens as gibberish. A CSV does not say what it is written in, so a Thai export in UTF-8 without a byte-order mark comes out as Latin punctuation on a Windows machine. This works out the encoding, reads it correctly, and writes the result with the mark so Excel opens it properly.
Does this make me GDPR or PDPA compliant?
No. Compliance is a property of what your organisation does with data, not of a tool, and nobody can sell you it. What this does is remove the step where a file full of personal data is uploaded to a third party in order to be cleaned, which is one of the places those laws are most often broken by accident.