Data Quality

PII Detector for CSV Files

Finds columns holding personal data, by value and by column name, and masks every example it shows.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste or upload the file you are about to send, share or copy into a lower environment.
  2. Select Scan for personal data.
  3. Deal with anything marked critical first — those are identifiers and special category data.
  4. Treat a clean result as no recognised patterns found, not as a clearance: free text can hold anything.

What pii detector does

The only PII scanner worth using on real data is one the data never leaves, which is why this one runs entirely in the page. Nothing is uploaded, nothing is stored, and closing the tab is all it takes to be rid of the file. That is not a privacy policy; it is what the tool does, and you can watch the network tab while it runs.

Detection works two ways, because neither is enough alone. Values are matched against patterns — a payment card is checked with the Luhn algorithm so a sixteen-digit order number is not reported as one — and column names are matched against the fields that declare their own contents. A column called salary holding 48000 is personal data, and no value-level pattern will ever tell you that. Every example shown in the report is masked, so the report itself is safe to paste into a ticket.

Frequently asked questions

No, and that is the entire point. The scan runs in the page, nothing is uploaded, nothing is stored and closing the tab removes it. A PII scanner you have to upload real data to is a strange thing to exist, and this one does not ask you to.

Because some personal data is invisible at the value level. A column of numbers is just numbers until you see that the header says salary. Name, date of birth, gender, health and credential columns are all recognised this way, and the report says which findings came from the name rather than the contents.

No, every example is masked. That is deliberate: a report you cannot paste into a ticket or a screenshot without leaking the thing you were trying to protect is not much use, and there is no reason the report needs the full value to be readable.

It means nothing recognised was found, which is not the same thing. Free-text columns can hold personal data in any form, and this only detects shapes it knows. Treat a clean result as one input to the decision, not as a clearance.