Frequently Asked Questions

Does my text really stay on my device?

Yes. Detection and redaction run entirely as JavaScript in your browser. There is no upload endpoint in this application. Your text is never transmitted to us, never stored, and never logged.

You can verify this yourself in about ten seconds: open your browser's developer tools, switch to the Network tab, and paste text into the tool. No request carries your content.

Do I need an account?

No. There is no sign-up, no login, and no account. The tool works immediately.

What does it detect?

Eight rule groups: email addresses, phone numbers, API keys and access tokens (over twenty known formats including OpenAI, GitHub, AWS, Stripe, Slack and Google), JWTs, PEM private key blocks, internal hostnames and private IP ranges, password and secret assignments in configuration text, and credit card numbers.

Why is credit card detection switched off by default?

Because long digit strings are everywhere. Order numbers, tracking numbers, and reference codes all look like card numbers to a pattern matcher. We validate matches with the Luhn checksum, which removes many false alarms, but not all of them, because some order numbers pass Luhn by coincidence. Rather than have the tool cry wolf, we leave the rule off and let you switch it on when you are working with payment data.

What is the difference between the three redaction styles?

Placeholders replace each match with a numbered token such as [EMAIL_1]. The same value always gets the same number, so if one address appears three times the AI can still tell it is one person. This preserves the structure of your text and is the default for that reason.

Partial mask keeps a recognisable fragment, showing an email as j***@example.com and a card as its last four digits. Useful when you need to keep track of which item is which.

Remove entirely deletes the matched value. Safest, but it can leave sentences that read oddly.

Will it catch everything?

No, and no tool can. Rules match well-defined shapes. They cannot know that “Project Falcon” is a confidential code name, that a revenue figure is unreleased, or that a paragraph is covered by an NDA. That is why the home page includes a short manual checklist to run through after scrubbing.

Can I turn rules off?

Yes, every rule is a visible switch. If you want the AI to see your own email address so it can draft a signature, leave that rule off. You decide what counts as sensitive in your situation.

Does it work offline?

Once the page has loaded, yes. The detection engine is part of the page, so it keeps working if your connection drops.

Will this site show advertisements?

PromptScrub may display clearly separated ads to help cover hosting and development costs. Third-party vendors, including Google, may use cookies as described in our Privacy Policy, with consent controls where required. PromptScrub does not provide the text you paste into the tool to advertising providers.

Something isn't working. What should I do?

Try reloading the page first, since a partially loaded script will stop the tool from responding. If the problem continues, email [email protected] with your browser and operating system, and we will look into it.