RunLocalTools

DICOM De-identifier: Remove Patient Data from DICOM Files in Your Browser

Free DICOM de-identifier that runs entirely in your browser. Strip patient names, IDs, dates and private tags, blank burned-in text, verify the result, and export a clean zip. No upload, no account.

What it does

Drop in DICOM files (CT, MR, X-ray, ultrasound, structured reports and more) or a whole study folder, and the tool removes or replaces the patient-identifying data inside them. You get back de-identified DICOM files, a verification result for each one, and, if you want them, clean PNG or JPEG viewing images with no metadata.

It covers the common jobs in one place: preparing images for research or teaching, sharing a case with a colleague, or attaching an example to a bug report, without sending a patient’s data to anyone’s server.

How it works

Everything happens inside your browser tab. The tool has its own DICOM reader and writer, with no outside code loaded, and it never makes a network request.

  • Standard rules. Four presets (Strict, Research, Teaching, Minimal) apply the DICOM PS3.15 Annex E Basic Application Level Confidentiality Profile, with the Annex E options for cleaning descriptors, keeping modified dates, keeping patient characteristics, keeping device identity, cleaning pixel data, cleaning graphics, and cleaning structured content. The output is labelled with the matching de-identification codes.
  • Consistent pseudonyms and UIDs. The same patient always gets the same pseudonym, and the same study, series and instance UIDs map to the same new UIDs, so a study stays grouped. Add a passphrase and the mapping is reproducible on another day.
  • Date shifting. Dates can be removed, kept, or shifted by a per-patient offset (or a fixed number of days) so the intervals between scans survive.
  • Free-text scrubbing. Names, IDs and any extra words you list are searched for in the descriptions and comments that are kept, and replaced.
  • A check on the output. After writing each file, the tool reads its own output back and searches it for every value it removed. Anything left over is listed so you can fix it.
  • Burned-in text. Draw boxes over text that is part of the image. Boxes are applied to every frame, and the tool re-reads the finished file to confirm each box is really blank. Uncompressed, RLE and JPEG Baseline images are supported. If blanking was requested and cannot be done, the file is not output at all.
  • Private tags. Private data is removed by default. A panel lists every private creator found, with tag counts, so you can keep the ones you trust.

How to use it

  1. Add files, or drop a folder onto the box. DICOM files are recognised by content, so a missing .dcm extension is fine.
  2. Pick a preset and adjust the options (dates, birth date, descriptions, private attributes, extra words to scrub).
  3. Open a file’s card. Use Blank burned-in text to draw boxes over any text in the image, and Inspect tags to override individual tags (keep, remove, empty, hash, replace with a value, or shift a date).
  4. Press De-identify all. Check the verification result on each card.
  5. Download the zip. Large studies can be split into parts of about 250 MB, 500 MB or 1 GB. Optionally add clean viewing images.
  6. If you need to link the output back to the originals later, download the re-identification key (CSV or JSON). It is never placed inside the zip, so keep it somewhere separate and secure.

Your option choices can be saved as a small rule-set file and loaded again later. It holds settings and tag overrides only: no names, no passphrase and no scrub words.

Clean viewing images

The tool can export a PNG (or JPEG, with a quality slider) of the first frame of each file, or of every frame. Images are rendered from the de-identified file, so blanked boxes are already applied, and no metadata is written into them. File names follow the DICOM output names, which contain no patient details unless you choose to keep the original file names.

16-bit images are exported as 8-bit using the current window/level. These are viewing copies for slides, documents and quick sharing. They are not diagnostic images.

Supported formats and limits

  • Pixel blanking: uncompressed, RLE lossless and JPEG Baseline. JPEG 2000, JPEG-LS and lossless JPEG files can still be de-identified, but their pixels cannot be edited here.
  • Text in other character sets: values that use multi-byte or ISO 2022 character sets (for example Japanese) are shown as raw bytes in the inspector with a marker, rather than as garbled text. Names are still removed by tag, but searching free text for names does not work on those fields.
  • Not included: face defacing for head scans, text recognition for burned-in text, and DICOMDIR index files.
  • No certification. The tool follows a published standard and checks its own output, but it cannot promise compliance with HIPAA, GDPR or your institution’s rules. Burned-in text, free text and unusual private data still need a human to review them.

Privacy

Files are read and processed in your browser’s memory. Nothing is uploaded, and nothing is saved: a refresh clears everything. Only your option choices (such as the preset and zip size) are remembered between visits. Patient names, passphrases and scrub words are never stored.

FAQ

Is it safe to use with real patient data?

The files never leave your device and are not stored, which removes the main risk of online converters. You are still responsible for checking the result. Review the verification report, look at images that may have burned-in text, and follow your own organisation’s rules.

What is the difference between the presets?

Strict removes dates and birth dates and drops patient characteristics. Research shifts dates and keeps the birth year and patient characteristics. Teaching removes dates but keeps patient sex, age and size. Minimal changes only the direct identifiers and keeps dates and descriptions. Every option can be adjusted after you choose a preset.

Can I get the original identity back?

Only through the re-identification key you choose to download. It lists the original names and IDs next to their pseudonyms. Without it, there is no way to recover them from the de-identified files. Keep it away from the images.

Why was a file refused when I asked for blanking?

If you draw boxes and the tool cannot guarantee they were applied (for example, the image is compressed in a format it cannot edit), it refuses to output that file rather than hand back something that still shows the text. Remove the boxes to de-identify the metadata only, or blank the image in another program first.

Why are my exported images 8-bit?

PNG and JPEG exports from a browser are 8 bits per channel. A 16-bit scan is therefore shown through the current window and level, which makes the image good for viewing but not for measurement or diagnosis.

Does it work on a phone?

Yes, for small batches. Large studies are better handled on a computer, since the files are processed in memory.