Email & PII Masker

IP-like numbers (1.2.3.4) match many version strings (2.0.10.5). Off by default to avoid false positives — turn on only when you know your text contains real IPs.

Keeping first 4 + last 4 is the standard 'card display' format used by Stripe, banks, etc. Don't try to mask less than that — last-4-only is often required to look up a transaction.

Names and addresses don't have a reliable regex. For those, manual redaction (or LLM-based extraction) is still the right tool — out of scope here.

Yes — ?email=foo@bar.com gets masked just like prose. Same for emails inside JSON, logs, or HTML attributes.

No, and the gap matters. The mask preserves length and position, so j******n@e*****e.com still tells a reader the local part is eight characters, starts with j and ends with n, and that the domain has seven letters before .com — a short list of candidates, not an unknown. Everything the patterns do not recognise also survives untouched: names, addresses, account references, and the surrounding sentences that make a partly-masked record identifiable. Use this to scrub a log before pasting it into a ticket, not to produce a shareable dataset.

Often, because the patterns match shape rather than meaning. The phone rule takes any 9-to-20 digit run with spaces, dashes or brackets, so it also claims an ISBN like 978-0-13-235088-4 and a build stamp like 2024 10 01 1200. The card rule takes any 13-to-19 digit run, which catches an IMEI and a millisecond timestamp such as 20260822093000123. Over-masking is the safe failure, but it silently damages logs, so read the output before you use it and turn off the detectors you do not need.