PII Finder – Scan Documents for Personal Data in Your Browser

Find emails, phone numbers, ID and card numbers, addresses, names and hidden author metadata in text, PDF, Word and Excel files. Free, private, runs locally.

What it does

PII Finder reads text you paste or files you drop in and lists every piece of personal data it can find: email addresses, phone numbers, payment card numbers, national ID numbers, bank details, street addresses, dates of birth, IP addresses and more. It also checks documents for personal data hiding in their properties, such as the author name saved inside a Word file or PDF.

Each finding comes with a confidence level (High, Medium or Low) and an exact location: a line and column in a text file, a page number in a PDF, or a cell reference like Customers!B2 in a spreadsheet. You can then ignore false alarms, export a report, or download a redacted copy of the text.

What it looks for

Contact: email addresses and international or local phone numbers.
Financial: payment card numbers, IBANs, US routing numbers, bank account numbers, SWIFT/BIC codes and crypto wallet addresses.
Government IDs: US Social Security numbers and ITINs, Canadian SINs, UK National Insurance numbers, India Aadhaar and PAN, Spanish DNI/NIE, Nigerian NIN/BVN, plus passport and driver’s licence numbers when a label sits next to them.
Device and network: IPv4 and IPv6 addresses, MAC addresses, IMEI numbers and GPS coordinates.
Personal and address: dates of birth, street addresses, PO boxes and postal codes.
Names: found from titles (“Mr.”, “Dr.”), greetings, labelled fields such as “Full name:”, a built-in list of common given names, and any terms you add to your own watchlist.
Hidden metadata: author, last-modified-by and company in Word, Excel and PDF files, and the names behind tracked changes and comments.

How it works

Most detectors are more than a pattern match. A candidate number is only reported as a card, IBAN, Aadhaar, SIN, IMEI or routing number if it passes the checksum for that format (Luhn, mod‑97, Verhoeff and so on), so a random 16‑digit order number does not get flagged as a card. Numbers that have no checksum, like US Social Security numbers, are checked against the format’s real rules (for example, area codes 000, 666 and 900+ are rejected). IDs that look like any other number, such as a bank account or a passport number, are only reported when a label like “Account No:” sits nearby.

Every hit gets a confidence level. High means the value passed a checksum or is unambiguous, Medium means a pattern plus supporting context, and Low means a heuristic guess. By default you see High and Medium; switch to “Everything” to review the Low matches too. Name detection is the least certain category and is always Medium or Low.

For spreadsheets and CSV files, the tool also reads the column headers. A column titled “Phone”, “DOB” or “Full Name” makes the values in that column count as such, even when they are bare digits that a text pattern would ignore.

You can add your own watchlist (client or staff names, project code names) and custom rules in the form Label :: regular expression. Rules that could freeze the browser tab, for example nested repeating groups, are skipped with a warning rather than run.

How to use it

Paste text into the box, or drop in files. You can add several files at once.
Wait a moment while the scan runs. Each file shows an overall risk level and a count of findings.
Click a file to see only its results, and click a category chip to hide or show that type of finding.
Open “View in document” on any finding to see it highlighted in context. Values are masked on screen until you tick “Reveal full values”.
For a false alarm, choose “Not PII – ignore this” for that one hit, or “Ignore this value everywhere”.
Export a CSV, JSON or Markdown report, or download redacted text using tags ([EMAIL]), consistent tokens ([EMAIL_1]) or block characters.

If a PDF has no text layer or you add a photo of a document, the tool offers a “Run OCR” button to read the text from the image first. Once you have found what needs to go, redact the PDF itself or black out regions of an image, since this tool’s redaction applies to the extracted text rather than the original file.

What happens to the results

Reports contain masked values by default, so a shared report does not become another copy of the data. Raw values are included only if you tick the box. CSV reports also neutralise cells that start with =, +, - or @, so opening a report in a spreadsheet cannot run a formula hidden in the scanned data.

Found a problem in a customer list? Strip names and IDs with the CSV anonymizer before sharing it. If you only need to blank out patterns in pasted text, the sensitive data masker is quicker. And because photos often carry GPS coordinates in their EXIF data, Bare can remove that metadata before you share an image.

Supported formats

Type	Formats	Notes
Plain text	`.txt .md .csv .tsv .json .ndjson .log .html .xml .eml .yaml .ini .sql .rtf .vcf .ics .srt`	UTF‑8 and UTF‑16
PDF	`.pdf`	Text layer, page numbers, document properties; OCR for scanned pages (first 30)
Word	`.docx`	Body, headers, footers, footnotes, comments, tracked changes, author properties
Spreadsheets	`.xlsx .xls .xlsm .ods`	Every sheet including hidden ones, with cell references
Images	`.png .jpg .webp .bmp .gif`	Via OCR you start yourself (English text)

Limitations

Detection is based on patterns, checksums and context. It is a strong first pass, not a guarantee. No findings means “nothing obvious”, not “nothing there”.
Name detection is heuristic. It works best on Latin-script names with a title, a label or a common first name. Expect some misses and some false alarms.
The old .doc, .ppt and password-protected files are not supported. Save older Word files as .docx first.
Spreadsheet cell comments and formulas are not scanned, only the displayed cell values. Email files (.eml) are read as text, so base64-encoded bodies and attachments are not decoded.
Text inside images embedded in a PDF is only read if you run OCR, and OCR covers the first 30 pages.

FAQ

Are my files uploaded anywhere?

No. Scanning runs entirely in your browser and no file contents or findings are sent to a server. The only network activity is downloading the open-source reading libraries (PDF, Word and Excel parsers, and the OCR engine if you use it) from a public CDN the first time they are needed. See the Privacy section for details.

Why did it flag something that isn’t personal data?

Order numbers, version strings and reference codes can occasionally resemble IDs or phone numbers. Checksums remove most of these, and the Low-confidence filter hides the shakiest guesses by default. If one slips through, use “Not PII – ignore this” for a single hit or “Ignore this value everywhere” for a repeating one.

Why did it miss something I know is there?

Without a label or a checksum, a plain number is just a number, so a bare 11-digit string could be a phone number, an ID or an order number. Names are especially hard. Add a label-style hint to your data, put specific names in the watchlist, or write a custom rule for your own formats.

Can it read scanned PDFs and photos?

Yes, through OCR. When a PDF has little or no text layer, or when you add an image, a “Run OCR” button appears. OCR is opt-in, reads English text, and downloads a recognition engine the first time you use it.

Does it check document properties, like the author’s name?

Yes. It reports the author, last-modified-by and company stored in Word and Excel files, the PDF author, and the names attached to tracked changes and comments. PDF creator and producer fields are reported only when they do not look like ordinary software names.

Will my files still be here after I refresh?

By default, yes. The files you add are kept in your browser’s own storage so you can pick up where you left off. Findings are never stored; they are recalculated when the page reloads. You can turn this off with “Remember files & text after refresh”, and “Clear all files & text” removes everything immediately.

Privacy

Local by default. Every feature on this page runs on your device: parsing, detection, the checksum checks, the report and redaction exports, and the ignore list. No account is needed and nothing you scan is sent to any server.

What uses the internet (and what doesn’t leave your browser). The first time you scan a PDF, Word file or spreadsheet, the page downloads the matching open-source library from a public CDN. If you use OCR, it also downloads the OCR engine and English language data. These downloads send none of your data. There is no feature in this tool that uploads your text or files.

What is stored in your browser. Your added files and pasted text are kept in your browser’s IndexedDB, only on this device, so they survive a refresh. Your settings (including any watchlist and custom rules you type) are kept in local storage. “Ignore everywhere” entries are saved as one-way hashes, not as the values themselves. Use “Clear all files & text” and “Reset settings & ignore list” to remove all of it, or switch off “Remember files & text after refresh”.

The small “report a bug” button at the bottom of the page only sends anything if you fill in and submit the form yourself.