VoriTools

Data Masker for Logs, JSON & CSV

Choose the patterns to mask and review the output before sharing. Masking is pattern-based: names, addresses, IPv6 and secrets without a recognisable key stay in the text.

Runs locally in your browser
View category: Security & Cryptography (30)
This tool processes all data locally in your browser.
Source dataPaste JSON, CSV, configuration, or logs.
Masked output — review before sharing
Run the tool to display the locally processed result here.

How to mask emails, IP addresses, credentials and phone numbers

Paste the text — a log excerpt, a JSON body, a CSV line — tick the patterns you want to hide and press Mask data. Every match is replaced by a numbered placeholder such as [email_001]; the same value always receives the same placeholder, so two lines that share a token stay comparable in the output.

The work runs in this browser: nothing is uploaded, the page keeps working offline, and the summary line counts what was replaced. Switch Replacement style to Partial redaction to keep a recognisable head and tail — alex@example.com becomes a•••@example.com, 203.0.113.42 becomes 203.0.•••.••• — instead of a numbered token.

  1. Paste the sample into Source data, or press Load example to fill it with a log line, a Bearer header, an API key, a phone number and a JSON object.
  2. Tick the four pattern groups you need: Emails, IP addresses, Credential values, Phone-like values. A group you leave unticked is never touched, whatever its content.
  3. Keep Replacement style on Stable placeholder when the output has to stay machine-readable, or choose Partial redaction when a reader should still recognise the shape of the value.
  4. Press Mask data and read the summary under the output: the example reports Secrets: 3 · Emails: 2 · IP addresses: 1 · Phone-like values: 1 and the status line says 7 value(s) were masked locally.
  5. Press Copy or Download for the result, then check it once more before sharing. The sections below list exactly what each pattern group covers and what it leaves untouched.

What each pattern group matches, and what it leaves alone

Emails and IPv4 addresses

The email rule matches a local part and a domain, including accented letters and internationalised domains, so josé@example.com and user@münchen.de are both replaced. A tagged address such as a+tag@Example.COM is masked once and keeps a single placeholder, and punctuation is left outside the match: "contact a@b.co, or b@c.example.org." becomes "contact [email_001], or [email_002].".

The IP rule covers IPv4 only: four dot-separated groups of at most 255 each. A version string written as four short groups, such as 1.1.1.4 in "openssl 1.1.1.4", matches that shape and is masked as an address. IPv6 is not covered by any rule — 2001:db8::1 passes through untouched — and a dotted quad stays readable when you untick IP addresses.

Credential values and phone-shaped numbers

A credential value is masked when a recognised key is followed by a colon or an equals sign and at least four characters: api_key, access_token, refresh_token, password, passwd, secret and token, with a prefix such as db_password, MY_SECRET or the x-api-key header, and their plurals. Values written after the Basic and Bearer schemes of an Authorization header are masked as well.

Phone detection is limited to values that have a phone shape: a + country prefix, parentheses, grouped digits such as 415-555-0199, 030 12345678, +49 30 12345678 or 99 88 77 66 55, or a bare run of ten or eleven digits. A bare run of sixteen digits and up is treated as a card number and masked too, so 4111111111111111 and 4111 1111 1111 1111 both disappear.

What is deliberately left alone

Dates, timestamps, decimals and long identifiers keep their shape: 2026-09-24, 24.09.2026, 09-24-2026, 2026-09-24T12:30:00Z, 3.14159265 and ts=1718000000000 all pass through unchanged. That is a fix, not a gap: the previous version of this page masked a date on its own and turned the log line 2026-09-24 12:30:00 into [phone_001]:30:00, which made the field it was meant to protect unreadable.

Names, postal addresses, IPv6 addresses and secrets with no recognisable key — a bare base64 blob, a password written without its field name — stay in the text, and so does anything outside the four groups. Running the tool a second time over its own output changes nothing, because a bracketed placeholder is not a match for any rule. For data that has to be fully anonymous, edit the result by hand as well.

Recent tools: