Anonymize a CSV or JSON file

E-mail addresses become made-up ones on example.com, example.org or example.net, which can never receive mail. Phone numbers keep their format, their country code and the first two digits after it, which in most countries say what kind of number it is and where (a mobile in Singapore starts with 8 or 9, one in China with 13 to 19), and get new digits for the rest: +65 9123 4567 becomes +65 91 and six new digits. The country code is read from the list of assigned codes, so it stays with or without a space after it (+6591234567 keeps +65); a number of five digits or fewer, not counting its country code, keeps none of its digits. Names become names from a fixed list, in the same shape (First Last, or Last, First); a name written in Chinese characters becomes a made-up Chinese name of the same length, up to four characters, in characters written the same in Simplified and Traditional Chinese (陈伟 becomes something like 林浩). Company names become made-up company names with the same legal form, kept as written: Analytical Engines Pte. Ltd. becomes something like Willow Gate Works Pte. Ltd., and 上海明华贸易有限公司 something like 益航物流有限公司, in characters written the same in Simplified and Traditional Chinese. Identifiers keep their shape: every digit and letter is redrawn, separators stay, so C-1001 becomes something like K-7382; a Chinese resident ID number becomes another well-formed one, with a date of birth between 1950 and 2005 that the calendar has and a valid check digit (an X stays an X). Dates are all moved by the same number of days, so intervals between them stay right. Each column can instead keep only part of it (the domain of an e-mail, the first three digits of a phone after its country code, the initials of a name, the last four characters of a code, the year and month of a date), become a short code (the same value gets the same code), or be removed altogether.

Each column's first filled value and what the files will hold for it, with the choice made for that column, and the choice suggested for it marked in its list. Initials, a domain, the first digits of a phone, the last four characters, the year and month, Keep as it is and Remove the column are shown exactly as the files will have them. Made-up values, short codes and shifted dates come from a key: with your passphrase typed, the example is the value the run writes; without one, the example is marked for example, as a run without a passphrase draws a key of its own. The examples stay on this page: they are not in the files, the report or the page's events.

Yes, within one run: the same e-mail address, name or ID maps to the same replacement in every column and every file you dropped together, so an order still points at its customer. Two different originals never share a replacement. This is what keeps test data joinable; it also means the result is a pseudonym, not an erasure: whoever has both the original and the result can line them up.

Type a passphrase before pressing the button. The same passphrase with the same choices on the same data gives exactly the same output, including the day offset. Without a passphrase a new random key is drawn for every run, so nothing about one run can be reused against another. The key itself never appears in the files or the report and is not stored anywhere. Start again clears the passphrase and the day offset with the files, and a link cannot fill in the passphrase, so it never travels in an address.

No, and the report says so. It is pseudonymisation with a consistent mapping. Rare values, free text, and combinations of columns that are kept (a postcode with a birth date, for instance) can still identify a person. The report lists residual findings in the kept columns: the values of a column whose header says it holds people's names or street addresses, values that still look like e-mail addresses, phone numbers or Chinese resident ID numbers, and values that equal a value replaced elsewhere or contain one written in Chinese characters (陈伟的订单 after 陈伟 was replaced). Read it before sharing the result, and remove what you do not need or give it a short code.

By their values first: a column whose values are mostly e-mail addresses, dates, IP addresses or Chinese resident ID numbers (18 characters with a date of birth the calendar has and a valid check digit) is taken for that whatever its name. Names and identifiers cannot be told from their values, so the header decides, in English or in Chinese, Simplified or Traditional. Names: name, first name, surname, customer name and the like, and 姓名, 名字, 联系人, 客户名称 or another word for a person ending in 人 (收件人, 负责人). Identifiers: id, uuid, account, passport, licence, username and headers ending in id, no or number, and 身份证号, 证件号码, 护照, 账号, 用户名 or headers ending in 号, 编号 or 代码. A header that names a phone (phone, mobile, tel, 电话, 手机, 传真) makes a phone column, never an identifier (Phone number, 手机号), and then values of 7 to 15 digits count as phone numbers even without a plus sign or separators, such as 62345678; without such a header, phone numbers must look dialled (a plus sign, separators, or ten to eleven plain digits). In a Chinese header the last word decides, so 联系人电话 is a phone and 联系人邮箱 an e-mail, not a person. A header that says street address (address, street, 住址, 地址, 收货地址, 门牌, 街道, 小区) makes the column a short code unless you choose otherwise, whatever its cells look like (house numbers too) and in every file that has the header, unless its values are e-mail or IP addresses, which get made-up ones of their own: the same address gives the same 10-character code within a run, so rows of one household still go together, and a kept one is named in the report; postal-code headers (postal code, postcode, ZIP code, 邮编, 郵編, 邮政编码, 郵政編碼, 郵遞區號) also get short codes by default, including leading-zero and alphanumeric codes; a city or province (city, state, 城市, 省份) is kept unless you choose otherwise; e-mail, IP and MAC address headers follow the rules for those. Every guess is shown with its reason, and you can change it; a column of company names is told apart from people's names: its header names a company (company, vendor, employer, 公司, 企业, 单位名称, 供应商) or most of its values end in a legal form (Pte. Ltd., LLC, Inc., 有限公司, 股份有限公司), and it is given made-up company names with the legal form left as written. A bare 单位 is a unit of measure, 公司联系人 is a person, and people's names under 客户名称 stay people's names.

2024-03-15 (with an optional time), 2024/03/15 and 15/03/2024, 15.03.2024 or 15-03-2024. Slashed dates are read as day/month/year unless a value in that column proves month/day/year (a second number above 12 with no first number above 12); the report says which way each column was read, and a value that is not a day the calendar has is kept and counted. A value the tool cannot read as a date is left as it is and counted in the report.

An array of objects, one object per row, or an object that holds such an array and nothing else (for example {"data": [...]}). An object with other data beside the rows is refused before anything runs, so nothing passes through unscanned. Keys become columns. Nested objects and arrays inside a row are kept exactly as they are; they are neither scanned nor changed. The output has the same shape: the same wrapper, even one whose name is empty, each row's keys in their own order, and every number exactly as the file wrote it, even an ID too long for the ordinary number type of a computer, such as 9007199254740993, so two such IDs never merge. It is written with the file's indentation (tabs, or the same number of spaces, or on one line when no line was indented), line breaks and final line break; within a line the spacing is the standard one, a space after each colon when indented and none on one line. A number whose replacement is digits, a code or a phone number redrawn digit for digit, stays a number, exact however long; a replacement with letters in it is written as text.

The file is refused, and the message names the first such row. A cell beyond the last header name belongs to no column, so it could not be classified, and cutting it would let it pass unscanned. Add header names for those cells, or even out the rows first (CSV Cleaner does that), then open the file again. An empty extra cell, as a trailing delimiter makes, holds nothing and is simply dropped. When nothing is changed, a CSV with a clean header row, rows as long as the header and quotes only where they are needed comes back byte for byte: its delimiter, each record's own line ending (CRLF, LF or a lone CR, mixed or not), its blank lines, its byte order mark and its final line break.

Nothing leaves your browser and nothing is written back anywhere: the result is always a new download. Selecting a related subset of rows across tables (an order and every record it depends on) and connecting to databases are not part of this page. Free text is not searched for names in general: only the values replaced in other columns are looked for in it, a whole cell or a single word equal to one, or, for a value written in Chinese characters, anywhere in the text.

No. The page loads a small script into your browser and every operation runs on your device. You can check this yourself in the browser's network panel: after the page has loaded there are no upload requests. Closing the tab discards the file.

No. These basic tools are free and store nothing on our servers. The only limits are the tool's own: files up to 32 MB each. Within them, the practical limit is your device's memory.

Nothing you open or type. While the tab is open, the tool pages keep a short list of the steps taken in it, in the tab's session storage: the step (page opened, started, succeeded, first success, used again or failed), the tool's name, the time, how many files were used and, for a failure, an error code; never a file name, the contents of a file or your text. It holds at most the latest 200 steps, and the browser deletes it when the tab closes. The page never sends it. Where a Report a problem button is shown, you can attach the last 20 steps to your report; nothing is attached unless you tick that box. In local storage the page keeps only choices you made: a Light or Dark theme until you choose System again, the language you picked with the EN / 中文 switch if it differs from your browser's language, and this tool in your recently used list if you switched that list on at the tools page.