Most people do this in Excel, and Excel is where it goes wrong. A spreadsheet of employees or customers has to go to a vendor, so somebody selects the email column and types over it. What gets missed is never the column they were looking at.
The shape is usually the point. An email masked to [email protected] is still shaped like an email, so it still passes the import the vendor is testing. [REDACTED] does not.
But the stable pseudonym is the one style here that survives a join. Mask a customer id to ##### and every row looks identical, taking the count of repeat customers with it. A pseudonym derived from the value stays the same for the same id, so the shape of the data survives even though the value does not.
And one warning matters more than it looks: the row with the wrong number of fields. A comma inside an unquoted address shifts every later field one place along — so the value you asked to mask is now in the next column, which nobody masked, and the file that comes out still looks clean.
No. There is no upload and no file picker — you paste the rows in and the masking happens in your browser, in this site’s own calculation engine. Nothing is transmitted, logged or stored, which matters more here than on any other page: what people paste into this tool is a staff list or a customer export.
Because a file picker would add nothing and cost something. Reading a file is asynchronous and holds the whole spreadsheet in memory, and the result is the same rows you can select and copy out of Excel in two keystrokes. Pasting keeps the tool instant on a phone and keeps the promise simple: the data goes into a text box on a page, and the page does not talk to anything.
Digits become #, letters become x, and everything else — the @, the dots, the hyphens, the spaces — stays. So an email still looks like an email and a nine-digit reference still has nine digits. That is usually what makes a masked file still usable for testing an import, because the column still validates.
For when equal values have to stay equal. Masking a customer id to ##### makes every row look the same and destroys any count of repeat customers; replacing it with a pseudonym derived from the value keeps all of that, because the same id always produces the same token. It is the only style here that survives a join.
Unsalted, yes — for anything from a small set. A pseudonym is a hash, and there are only ten billion Philippine mobile numbers, so a laptop tries all of them and matches every token in minutes. Put anything in the salt field and that stops working, at the cost of the tokens being different next time unless you use the same salt again. The page says which of the two it just did.
Because that is how the masking silently fails. A comma inside an unquoted address shifts every later field one place along, so the value you asked to mask is now sitting in the next column — which nobody masked — and the file that comes out still looks clean. Every such row is listed by number so you can fix the quoting before the file goes anywhere.
No, and this is the limit worth reading twice. Masking a column removes one identifier, not identity. A masked name beside a job title, a branch and a start date still describes one person, and so does a rare value — an unusual surname, the only row from a small office — even after the letters are replaced. Read the output before you send it.
Because a file whose columns are called xxxx is not anonymous, it is unusable — and somebody who cannot use it sends the original instead. The header names the columns; it does not contain anybody’s data.
Twelve hex characters is 48 bits. The birthday bound puts an even chance of one collision at around 17 million distinct values. Six hex — what a token looks like in most tools — collides at about four thousand, which a staff list reaches. A collision here silently merges two people into one group.
Nothing you paste is transmitted or stored. Masking a column is not anonymisation — a masked name beside a job title, a branch and a start date still identifies one person, and an unsalted pseudonym can be reversed for any value from a small set. Read the output before you send it. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
