Privacy Mask: Hide Sensitive & Personal Info (PII) by PaperWork

About

Privacy Mask hides personal and sensitive information in your text before it reaches an AI chat. It runs entirely on your own computer. No account, no server, no tracking. The text you write and the data it finds never leave your browser.

You stay in charge the whole time. Privacy Mask never sends a prompt for you and never changes your text silently. It shows you what it found, lets you choose what to hide, and waits for you to insert the masked text and press enter yourself.


HOW IT WORKS

Write or paste your prompt the way you normally would. Open the Privacy Mask panel and it scans the text right away, on your device. You get three things side by side: the original, a masked preview, and a list of every item it detected. Turn individual items on or off if it caught something you want to keep, or missed something you want to add. When the preview looks right, insert the masked version into the chat box.

Each piece of sensitive data becomes a short placeholder, such as [EMAIL_1], [NAME_2], or [PHONE_1]. The link between a placeholder and its real value lives only in your current browser session. So when the AI replies, you can paste the answer back and Privacy Mask restores the real values locally, which keeps the reply readable for you. Close the session and that link is gone.


WHERE IT WORKS

Privacy Mask adds a quick privacy step to the major AI chat assistants you already use. It activates only on the supported chat sites and stays completely inactive on every other page.


WHAT IT DETECTS

Privacy Mask looks for the kinds of data that cause real trouble when they end up in a prompt.

Identity and contact details
- Names of people and of business entities
- Email addresses
- Phone numbers, validated across many countries rather than a single region
- Postal and street addresses

Financial and banking data
- Credit card numbers, checked with the Luhn algorithm
- IBAN and BIC / SWIFT bank codes
- Bank account numbers

Government and tax identifiers
- National and tax IDs for the United States, United Kingdom, Spain, Italy, France, Germany, the Netherlands, Russia, and the United Arab Emirates, each confirmed by its own checksum
- Passport numbers
- VAT numbers and the UAE Emirates ID

Secrets and credentials
- API keys and access tokens from common developer and cloud platforms
- Database connection strings that carry a username and password
- Bearer tokens and private keys

Technical and other identifiers
- Crypto wallet addresses
- IP and MAC addresses
- Vehicle VINs and license plates
- Dates and money amounts


BUILT TO AVOID FALSE ALARMS

A tool that masks everything that vaguely resembles an ID becomes useless fast. Privacy Mask works in two steps. A pattern finds a candidate, then a check confirms it. Credit cards pass the Luhn test. IBANs pass the mod-97 calculation. National IDs pass the checksum rules for their country. A random 11-digit order number sitting in your text is left alone, because it fails every one of those checks. Numbers that only mean something in context, like a tax ID, are masked when the words around them make the meaning clear, and ignored when they do not.


WORKS ON PDFS TOO

Sensitive data does not live only in typed prompts. Privacy Mask can open a PDF on your device and mask the text inside it, so the same protection covers documents you want to ask an AI about, not just what you type into the box.


YOUR OWN TERMS

Some sensitive words are specific to you: a project codename, a client alias, an internal product name. You can add your own terms, and Privacy Mask masks them next to the built-in detectors. Your custom terms are stored locally, like everything else.


WHY LOCAL-ONLY MATTERS

Many tools that promise privacy do their scanning on a server. To check your text, they first have to receive your text, which is the exact thing you were trying to avoid. Privacy Mask takes a different route. All detection happens in your browser, using pattern matching and checksums. There is no backend that could be breached, nothing is logged, and nothing is sold. If you want proof, open your browser's network tab while you use it. You will see no outbound requests.


WHO IT HELPS

People paste real, sensitive material into AI tools every day:

- Support agents pasting tickets full of customer names, emails, and order details
- Developers pasting code, logs, and config files that still hold API keys and connection strings
- Finance and operations teams pasting invoices, bank statements, and contracts
- Anyone drafting an email or document that names a real person

Privacy Mask lets you keep using AI for this work while keeping the personal and financial details to yourself.


ABOUT PAPERWORK

PaperWork builds document AI for banks, lenders, and fintech companies. Our main product reads financial documents such as bank statements, invoices, and KYC files, and turns them into structured, verified data. Handling that information carefully is the center of what we do, not a footnote to it.

Privacy Mask grew out of the same concern. We wanted a way to use everyday AI tools without exposing the personal and financial data we are trusted to protect, so we built one and made it free. PaperWork sits where AI, financial technology, and data privacy meet, and this extension carries that focus into daily use: keep the help that AI gives you, without giving away the data behind it. You can learn more about our work at paperwork.to.


WHAT PRIVACY MASK DOES NOT DO

- It does not send your prompts anywhere. You insert and send them yourself.
- It does not collect, store, or transmit your data off your device.
- It does not run analytics or telemetry.
- It does not load remote code. Everything it needs ships inside the extension.


A NOTE ON PERMISSIONS

Privacy Mask asks only for what the job requires. It reads and writes the input field on the supported AI sites, so it can scan your prompt and put the masked version back. It uses local session storage for the placeholder map and your settings. It uses a local offscreen step to process PDFs. None of this involves a server.


GETTING STARTED

Install the extension, open one of the supported AI sites, and write a prompt. Open the Privacy Mask panel, review what it found, and insert the masked text. That is the whole flow. There is nothing to sign up for and nothing to set up before it works.


COMMON QUESTIONS

Does Privacy Mask send my text anywhere?
No. Detection runs in your browser. No request leaves your machine to scan your text.

Will it submit my prompt for me?
No. It only inserts the masked text into the input field. You read it and decide when to send.

What happens to the link between [EMAIL_1] and the real email?
It stays in your current browser session and is used to restore values in the AI's reply. When the session ends, it is cleared.

Does it work in languages other than English?
The structured detectors (cards, IBANs, IDs, keys) work regardless of language. Context-based detection and labels currently focus on English and Russian, with more on the way.

Is it really free?
Yes. There is no paid tier and no account to create.


Privacy Mask is free, and the way it handles data is set out in full in our privacy policy. If a claim on this page matters to you, you can check it yourself, because the work happens where you can watch it: in your own browser.