Free tool

Free PII scanner: online PII detection

A PII scanner that runs in your browser: paste text or drop a file to see personal data and leaked secrets before you share it.

Updated

Results appear here as you paste

  • US Social Security number0
  • Payment card number (Luhn-checked)0
  • Email address0
  • Phone number0
  • Public IP address0
  • AWS access key ID0
  • AWS secret access key0
  • GitHub token0
  • Slack token or webhook0
  • Private key block0
  • Hard-coded key or password0

Runs entirely in your browser. Nothing you type is sent to us or stored. Pattern matching finds common formats; it can miss names, addresses and anything unusual, and can flag numbers that only look like a match.

Runs in your browserBuilt and maintained by the DataBroker team

How to use the PII scanner

  1. Step 1

    Add the text

    Paste rows, a log or a JSON export, or drop a text file up to 5 MB. Try the sample to see how it works.

  2. Step 2

    Read the findings

    Each detector shows a count and the first few matches, masked so they are not exposed on screen.

  3. Step 3

    Redact and share

    Copy or download a version with every match replaced by a label, then check it by eye before sending.

What the result looks like

The PII scanner on its own made-up sample rows: 8 possible findings, among them a US Social Security number, a Luhn-checked payment card number, 2 email addresses, 2 phone numbers, a public IP address and a hard-coded key, each shown masked, with buttons to copy or download the redacted text.
The scanner's built-in sample (fictional people and test numbers), after one click on “Try a sample”.

What is a PII scanner?

A PII scanner searches text for personally identifiable information, such as email addresses, phone numbers and government ID numbers, so it can be removed or protected before the text is shared.

More about the PII scanner

What it looks for

DetectorHow it decides
US Social Security numberThree, two and four digits with dashes; skips area numbers 000, 666 and 900 to 999 and all-zero groups, which are never issued
Payment card number13 to 19 digits from a known card range that pass the Luhn checksum, which filters out most random numbers
Email addressA name, an @ and a domain with a real-looking ending
Phone numberUS numbers with separators, or international numbers starting with +
Public IP addressIPv4 addresses, ignoring private, loopback and link-local ranges
AWS, GitHub and Slack keysThe fixed prefixes those services use, such as AKIA, ghp_ and xoxb-
Private key blocksThe BEGIN ... PRIVATE KEY header
Hard-coded passwords and keysA word like password or api_key followed by a value, ignoring obvious placeholders

Example: the sample has two customer rows and a config line. The scanner finds two emails, two phone numbers, one SSN, one card number, one public IP and one hard-coded key, eight findings in all, and the redacted copy replaces each with a label such as [REDACTED EMAIL].

When to use it

  • Before sending a data sample to a prospective buyer.
  • Before pasting logs or exports into a support ticket or an AI chat.
  • Before publishing a repository or a dataset, to catch keys left in config files.
  • As a quick check on a vendor's file before it goes into your systems.

The detectors are written so that scanning time grows in step with the size of the text, not faster, which keeps a five-megabyte file responsive even in a modest laptop browser.

Limits

It can missWhy
Names and street addressesThey have no fixed format, so patterns can't find them reliably
Identifiers from other countriesThe ID detector covers US Social Security numbers only
Data inside spreadsheets or PDFsIt reads plain text; export to CSV or text first
Numbers that only look like a matchA phone pattern can catch an order number; check before acting

Sources

2 sources · checked Nov 7, 2026

  1. Luhn algorithm (Wikipedia)Checked
  2. Social Security number (Wikipedia)Checked

PII scanner FAQ

All DataBroker questions →

Is my file uploaded?

No. The file is read by your browser and scanned there. Nothing is sent to us or stored, and closing the tab clears it.

Does a clean result mean the file has no personal data?

No. It means none of these patterns matched. Names, addresses and free-text notes can still identify people, so read the file too.

Which file types work?

Text formats such as CSV, TSV, JSON, logs, Markdown and source code, up to 5 MB. Convert spreadsheets and PDFs to text first.

Why are matches masked?

So the results panel does not put the sensitive values on screen in full. The redacted copy removes them entirely.

Can it check for GDPR or CCPA compliance?

No tool can do that from text alone. It finds data that may be personal; whether you may share it depends on how it was collected and the law that applies.

Related

  • The codebase value calculator with 50,000 lines of code typed in at $100 an hour: an estimated rebuild cost of $2,218,060, 145.9 person-months of effort over 16.6 months with an average team of 8.8 people.
    Codebase value calculator

    A codebase value calculator that reads a public GitHub repository in your browser and estimates rebuild effort and cost with basic COCOMO.

Guides that use the PII scanner

Free tool

Try the PII scanner

A PII scanner searches text for personally identifiable information, such as email addresses, phone numbers and government ID numbers, so it can be removed or protected before the text is shared.

  • Free
  • No sign-up
  • Runs in your browser
Use it nowSee the course