PII Tokenizer

About this tool

PII Tokenizer scans a block of text and replaces personally-identifiable information with deterministic, format-preserving pseudonyms. Unlike masking or redaction, the tokens keep the original shape and stay consistent: the same value always maps to the same token, so you can share logs, datasets, or support tickets that are de-identified yet still linkable — you can group, join, or de-duplicate on the tokens without ever seeing the real data.

It detects and tokenizes:

• Email addresses
• Phone numbers (US-style, with optional country code / area-code parens)
• IP addresses — IPv4 (octets stay 0–255) and IPv6 (groups stay valid hex)
• Credit-card numbers — 13–19 digit runs, Luhn-validated on the way in, and the token is re-Luhn'd so it stays a checksum-valid card number
• US SSN-like numbers (123-45-6789)

Worked example

Input:

Contact Ada at [email protected] or [email protected]. Card 4111 1111 1111 1111.

Output (illustrative — the exact tokens depend on your secret):

Contact Ada at [email protected] or [email protected]. Card 3948 2071 6653 4890.

Notice the two copies of [email protected] map to the same token, the domain is preserved, the phone/card keep their punctuation and length, and the card is still Luhn-valid. Run it again and you get the identical output.

Options

• Secret key — scopes the deterministic mapping. The same secret always yields the same tokens, so datasets tokenized on different days still join. A different secret yields a completely different, unlinkable set — so keep your key private if you need the mapping to be stable and unguessable. Leave it blank to use a built-in default key.
• Keep email domains — on by default: only the local part (before @) is pseudonymized, so @gmail.com vs @acme.com stays visible for segmenting. Turn it off to pseudonymize the whole address.

Privacy

Everything runs in your browser via WebAssembly — the text is never uploaded to a server. You can also run it from the gizza CLI or inside a gizza chat, which return per-category counts of what was tokenized.

Limits & edge cases

• Detection is pattern-based (regex), so free-text PII like names, street addresses, and dates of birth is not caught — those need context-aware entity recognition this tool doesn't do. Review the output for high-stakes use.
• Tokens are keyed on the exact matched text, so the same phone written two ways ((415) 555-0132 vs 415.555.0132) produces two different tokens.
• Tokenization is one-way: it's a keyed HMAC, not a lookup vault, so there is no detokenize/re-identify step. It gives you linkability, not reversibility.

FAQ