See the personal data in your text before you send it
TextVeilPad marks emails, phone numbers, IP and MAC addresses, card numbers, IBANs, JWTs, API keys, UUIDs, coordinates and dates with plain regular expressions and checksums — then replaces each kind the way you choose. No model, no account, no upload.
Card 4111 1111 1111 1111 was declined at 09:42 from 203.0.113.47 — call +7 903 555 01 42 or write to anna@example-shop.com.
The editor
Paste or drop your text, check what was found, and choose how each kind is covered.
Detection and replacement run in this tab. Your text is never sent anywhere — there is no server to send it to.
The redacted version appears here as soon as there is text above.
Four things that matter here
Checksums, not guesses
Fifteen detectors, each with its own pattern — and where a standard defines a check, the tool runs it: Luhn for card numbers (with brand detection), mod-97 for IBANs, modulus-11 for SNILS, INN and the Estonian isikukood. A sixteen-digit order number is not reported as a card.
Replacements that keep the text useful
Each type gets its own treatment: a plain token, a numbered token that stays the same for the same value everywhere in the document, a partial mask that keeps the last four digits, or a fake value that is still format-valid — Luhn-correct cards, mod-97-correct IBANs, 192.0.2.x addresses, example.com emails.
Your identifiers, your patterns
Order numbers, internal ticket references, contract codes: add a regular expression, see how many times it matches the text in front of you, and keep it on this device if you use it often. Custom patterns take priority over the built-in ones.
Nothing leaves the tab
The page has no upload endpoint, no analytics and no third-party scripts. Detection, replacement, the mapping table and the downloads are all built in your browser; once the page has loaded you can disconnect and keep working.
A redaction pad for text
TextVeilPad is a redaction pad for text: you paste a support ticket, a log excerpt, a CSV row or a database dump, and the editor marks every span it recognises as personal or secret — email addresses, phone numbers in international and local notation, IPv4 and IPv6 addresses, MAC addresses, payment card numbers validated with the Luhn algorithm, IBANs validated with the ISO 13616 mod-97 check, URLs, dates in ISO and written form, UUIDs, JWTs, API keys and other high-entropy strings, decimal and DMS coordinates, and — if you switch them on — national identifiers and postal codes. Names are deliberately not guessed: no reliable pattern exists for them, so the tool offers a custom word or regex list instead of pretending.
What matters after detection is what you put in place of the data. A ticket where every address became [EMAIL] is safe but useless for debugging; one where the same address became [EMAIL_1] everywhere keeps the thread of the conversation intact. TextVeilPad supports both, plus partial masks that leave the last four digits of a card, and synthetic values that are fake yet still parse — a Luhn-valid test card, an IBAN whose check digits are recomputed, an address from the 192.0.2.0/24 documentation range. Every replacement is deterministic, so running the same text twice produces the same output, and the mapping table is available as a CSV when you need to reverse the process yourself — with a warning, because that file is the key to everything you just hid.
Guides & articles
What the law counts as personal data, how to clean a log without breaking it, and the patterns behind the detectors.
What counts as personal data under GDPR
Most people picture a name and a passport number. The legal definition is far wider: IP addresses, cookie IDs and combinations that look harmless alone.
Redacting logs and tickets before sharing
A single log line can carry an email, a session token, an IP and a card number. What actually leaks, how to cover it, and where redaction stops helping.
Regex patterns for emails, phones and cards
Matching the shape of a value is only half the job. Checksums, digit counts and honest boundaries separate a useful detector from a false-positive machine.
Frequently asked questions
Is my text uploaded anywhere, or sent to an AI model?
No. TextVeilPad is a static page: the detection, the replacements, the mapping table and the downloads all happen in your browser tab, in JavaScript. There is no upload endpoint, no analytics and no third-party script on the page, and no language model is involved — everything is regular expressions and published checksum algorithms. Once the page has loaded you can turn off your network connection and keep working.
How accurate is the detection, and what about false positives?
Patterns with a checksum — card numbers (Luhn), IBANs (mod-97), SNILS, INN and the Estonian isikukood — are close to exact: a random number almost never passes. Patterns without one are a trade-off. Phone numbers and dates share their shape with order numbers and version strings, so you will occasionally see something flagged that is not personal data; postal codes and national ID patterns are noisy enough that they are switched off until you switch them on. Every finding is visible in the editor and can be left alone with one click, so treat the tool as a second pair of eyes, not a guarantee.
Why does it not find people's names?
Because no regular expression can tell a surname from an ordinary capitalised word, and a detector that finds half the names in a document is more dangerous than none: it makes you believe the text is clean. Reliable name detection needs a language model or a curated list, and neither belongs in an offline page. Instead, add the names you care about as custom patterns — a plain list like Petrova|Ivanov|Tamm works fine as a regular expression, and it is applied with priority over the built-in detectors.
What does “numbered token” mean, and when should I use it?
A plain token turns every email address into [EMAIL], which is safe but destroys the thread of a conversation — you can no longer tell whether two lines refer to the same person. A numbered token gives each unique value its own number, [EMAIL_1], [EMAIL_2], and reuses it everywhere that exact value appears. Use it whenever someone will still have to read or debug the text: a support engineer can follow [IP_1] through a log without ever learning the address.
Are my custom patterns stored anywhere?
Only if you ask. Patterns you add live in the page's memory for the session; ticking “Remember my patterns on this device” copies them into this browser's localStorage, which never leaves your machine and is not readable by any other site. Unticking the box deletes the stored copy immediately. The text you are editing is never stored — not in localStorage, not anywhere else.
How large a file can I check?
The file picker and drag-and-drop accept text files up to 4 MB — .txt, .md, .csv, .tsv, .log, .json, .yaml, .xml and similar. Anything above about 48 000 characters is scanned in chunks with a progress bar so the page stays responsive, and above 200 000 characters the coloured highlighting switches off while detection and replacement keep working. For bigger inputs, split the file or paste the section you actually need to share.
Does it work with Russian text and other alphabets?
Yes. The interface is available in English and Russian, and the detectors are alphabet-independent: emails, phones, IPs, cards and tokens have the same shape in any language. Dates are recognised in ISO form, in day-month-year and month-day-year numeric forms, and with month names written out in English and Russian. Custom patterns accept Cyrillic and any other Unicode text.
Can I undo a replacement?
There is nothing to undo: the editor always holds your original text, and the redacted version is produced next to it. Switch a data type off, change its mode, or use Before / Side by side to compare, and the result is rebuilt instantly. If you have already shared the redacted text and need to reverse it, the mapping table export pairs each replacement with the value it covered — keep that file away from the text it unlocks.