AI Lab · Free tool
Text anonymiser for ChatGPT, Claude or Gemini: mask sensitive data (reversible)
Paste a text: the tool finds emails, phone numbers, IBANs, RIBs, cards, ID numbers, API keys and passwords, swaps them for neutral placeholders, then restores the real values in the AI's answer. 100% local.
🔒 Everything is computed in your browser: nothing is sent to or stored on a server.
🔒 Nothing is sent or stored: the mapping table only exists in this tab's memory. Closing or reloading the page erases it for good.
1. Anonymise the text
Items found
Preview: what will be masked
2. Put the real values back into the answer
Mapping table (kept in this tab only)
| Placeholder | Category | Original value |
|---|
Detection rules
Transparent and checkable: here is exactly what the tool recognises.
| Category | Placeholder | Rule |
|---|---|---|
| Emails | [EMAIL_1] | Address of the form name@domain.ext. |
| Phone numbers | [PHONE_1] | Moroccan numbers 05, 06, 07 (with or without +212 / 00212) and international numbers starting with + (E.164 format, up to 15 digits). |
| IBAN | [IBAN_1] | Country code + 2 check digits + account, validated with the official check (modulo 97). An IBAN with a wrong check is not masked. |
| Moroccan RIB | [RIB_1] | 24 digits (bank, city, account, key), grouped or not. |
| Bank cards | [CARD_1] | 13 to 19 digits validated with the Luhn algorithm, the check payment terminals use. |
| Moroccan ID card (CIN) | [CIN_1] | 1 or 2 capital letters followed by 5 to 7 digits (e.g. BE123456). |
| ICE (company ID) | [ICE_1] | Moroccan common company identifier: 15 digits. |
| IP addresses | [IP_1] | IPv4 (4 numbers from 0 to 255) and IPv6. |
| Links with a token | [URL_1] | Links containing a sensitive parameter: token, access_token, key, api_key, secret, password, sig, signature, auth, code… |
| API keys | [API_KEY_1] | Public formats: Google (AIza…), OpenAI (sk-, sk-proj-), Anthropic (sk-ant-), GitHub (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_), AWS (AKIA…, ASIA…), Stripe (sk_live_, sk_test_, rk_live_), Slack (xoxb-, xoxp-…). |
| Private keys and JWTs | [SECRET_1] | "-----BEGIN … PRIVATE KEY-----" blocks (RSA, EC, OpenSSH…) and JWTs (three parts starting with eyJ). |
| Passwords | [PASSWORD_1] | The value written after "password:", "pwd=", "passwd:", "mot de passe :", "كلمة السر:" or "كلمة المرور:". |
| Your terms | [TERM_1] | Every term in your list (client names, company, address, project), case-insensitive. |
What the tool does not do
- Automatic detection is never exhaustive: always reread the anonymised text before sending it.
- Names of people, companies and addresses are only recognised if they are in your list of terms.
- A secret written in an unusual format may slip through: when in doubt, add it to your list.
- Anonymising protects the content you send, not your account: also adjust your AI assistant's privacy settings.
Why this tool
Reversible
Each value becomes a stable placeholder ([EMAIL_1], [PHONE_2]…). When you paste the AI's answer back, the tool puts the real values back in place automatically.
Secrets first
Google, OpenAI, Anthropic, GitHub, AWS, Stripe or Slack API keys, private keys and JWTs: the costliest leaks are caught by their public format.
Validated, not guessed
IBANs are checked with their official check digits (modulo 97) and cards with the Luhn algorithm: fewer false positives, and your order numbers stay intact.
Frequently asked questions
Does the AI still understand my text with placeholders?
Yes, in the vast majority of cases: to draft a reply, summarise or correct, the AI does not need the real email or number. Readable placeholders ([CLIENT_1], [PHONE_1]) give it the context it needs.
Is my data sent anywhere?
No. Detection, replacement and restoration happen in your browser. The mapping table only exists in the tab's memory and disappears when you close it.
Is the detection complete?
No automatic detection is. Names of people and companies are only masked if they are in your list. Always reread the anonymised text before sending it.
What if an API key has already been pasted into an AI?
Treat it as compromised: revoke it and create a new one in the service's console, then check its usage history. The Lab's security guide explains the steps.
Going further
Security: what you should never paste into an AI (and how to work anyway)
Read the guide →Play Store listing generator
Open the tool →llms.txt and AI robots
Open the tool →Coding agent instructions file
Open the tool →Prompt library by profession
Open the tool →Automation ROI calculator
Open the tool →AI API cost calculator
Open the tool →Local AI hardware calculator
Open the tool →Business AI assistant designer
Open the tool →Company AI usage policy
Open the tool →Bring AI into your business, for real?
Automations, assistants, multilingual content, apps: I design solutions that are useful, measurable and respectful of your data.