Document PII Redactor

What the Document PII Redactor Detects

The redactor runs two cooperating layers, both entirely in your browser. The deterministic regex layer runs first and catches structured PII with high precision. The optional on-device NER layer then catches unstructured PII like personal names that no pure regex can reliably recognise. The output is exported in the same format you uploaded, so a redacted PDF stays a PDF and a redacted DOCX stays a DOCX.

How to Redact a Document

1. Drop a .pdf, .docx, .txt, or .md file into the upload area (up to 50 MB).
2. Pick a detection mode: Regex + NER for maximum coverage, or Regex only for instant deterministic redaction.
3. Click Redact document. Detected items are replaced with stable, category-labelled tokens for text outputs, or covered with opaque black rectangles for PDFs.
4. Click Download redacted to save the document in the same format you uploaded.
5. Open the redacted file in your usual app to confirm the PII has been removed before sharing.

Why PDF Redaction Must Rasterise

A "redacted" PDF that only paints a black rectangle on top of the original text stream is not actually redacted — copy-pasting, searching, or rendering the file in a different reader can recover the underlying characters. To prevent this, every PDF page that contains a detected PII span is rendered to a canvas at 2.5× scale, the black redaction rectangles are painted into the bitmap, and the entire page is re-embedded in the output PDF as a PNG image. The original text stream for those pages is discarded. Pages with no detections are copied as-is so the rest of the document retains its original quality and selectable text.

Key Features

• Four formats in, same format out — accepts .pdf, .docx, .txt, and .md; exports a redacted copy in the same extension.
• Two-layer detection — deterministic regex (with Luhn and mod-97 validation) plus on-device BERT NER for unstructured names, organisations, and locations.
• Stable tokens — repeated values get the same placeholder, so the redacted document still reads naturally.
• Verifiable PDF redaction — affected pages are rasterised, not just overlaid, so the original text cannot be recovered by selecting or extracting it from the output.
• Offline after first load — the ~110 MB NER model is cached in IndexedDB on first use; the regex layer works offline immediately.
• Regex-only fallback — skip the model download entirely if you only need to redact structured PII like emails, phones, SSNs, cards, IBANs, and IPs.

When to Use a Document Redactor

• Sharing case files or contracts — strip client names, addresses, and bank details before sending a sample to a colleague.
• Submitting a CV or résumé — remove email, phone, and address before posting to a public job board.
• Reviewing internal incident reports — redact employee names and IP addresses before circulating a post-mortem.
• GDPR / HIPAA / SOC 2 reviews — produce an auditable in-browser path for any team member who needs to share an internal document externally.
• Compliance archival — keep a long-term copy of a customer record with personal data removed but structure preserved.

Why On-Device Detection Matters

Cloud-based document-redaction services typically require uploading the very file you are trying to protect. That defeats the threat model. This tool uses pdf.js, mammoth.js, and Transformers.js with a Web Worker to run the entire pipeline on your device — your document never crosses the network, and no detection result is logged anywhere outside this tab. Pair it with the PII Masker for AI Prompts when copy-pasting into ChatGPT or Claude, and the Prompt Secret Scrubber for AWS / GCP / OpenAI keys.

Validation Details

• Credit cards. Numbers between 13 and 19 digits are accepted only if they pass the Luhn (mod-10) checksum, eliminating most false positives on order numbers and reference codes.
• IBANs. Validated with the ISO 13616 mod-97 algorithm — a country prefix and matching checksum digits are required.
• IPv4. Each octet is range-checked (0–255), so timestamp-like sequences are rejected.
• NER spans. Aggregated with the Transformers.js simple strategy so multi-token entities (e.g. "Jane Doe", "Bank of America") are merged into a single redaction.
• PDF text runs. Every text run that overlaps a detected PII character span is added to the redaction list for its page — an entity split across multiple runs is still fully covered.