Goodbye Manual Redaction: MaskFlow AI, a Fully Client-Side PII Masking Tool

Every day, before pasting error logs, code snippets, and customer emails into ChatGPT, Claude, or Gemini, developers go through a tedious ritual: manually replacing API keys like sk_live_... and AIza... with xxxx, and masking customer names, emails, and phone numbers one by one. What's worse, after the AI returns results, you have to swap each placeholder back to the real production key. Cloud-based PII masking services seem convenient, but uploading sensitive code and logs to third-party servers fundamentally defeats the purpose of privacy protection.

One developer built MaskFlow AI for this—a client-side privacy tool that runs entirely in browser memory. No network requests, no server uploads, and your API keys never leave your device.

Why Regex Replacement Isn't Enough

Simple string-replacement scripts can handle keys with known formats, but real-world development scenarios are far more complex. MaskFlow v2.0 takes a targeted approach on several technical fronts, making it capable of handling heavier workflows.

Catching Unknown Keys with Shannon Entropy

Not every key has a tidy prefix like sk_live_. MaskFlow computes Shannon entropy in real time (threshold $H(X) \ge 3.85$ bits/char) combined with character class transitions to automatically identify and mask high-entropy unknown tokens. The mapping table displays entropy scores (e.g., H=4.42b), so you can clearly see which fragments were flagged as sensitive. This approach breaks free from the limitations of pattern matching and is especially useful for randomly generated internal tokens.

Shannon entropy was originally a measure of uncertainty for random variables in information theory, with the formula $H(X) = -\sum_{i} p_i \log_2 p_i$, where $p_i$ is the probability of the $i$-th symbol in the character set. In key detection scenarios, it is used to quantify how "random" a string is: API keys, session tokens, or hash values encoded from random bytes have a near-uniform character distribution and high entropy; whereas ordinary English words, variable names, or repeated structures common in UUIDs concentrate the character distribution and yield lower entropy. MaskFlow's threshold of 3.85 bits/char means that across roughly 64 possible characters (such as the base64url alphabet), the string's distribution has clearly deviated from natural language. The advantage of this method is that it doesn't rely on prefixes or fixed lengths, covering randomly generated tokens from internal systems; the cost is that long hashes, compressed data blocks, or high-entropy test fixtures may be misidentified as keys, so character class transitions (e.g., whether it contains both upper and lowercase, digits, and symbols) are typically combined to reduce false positives.

Synthetic Alias Mode Preserves Code Accuracy

Generic placeholders like {{EMAIL_1}} break TypeScript type checking, JSON schemas, or SQL queries. MaskFlow's synthetic alias mode instead uses syntactically valid fake data, such as user01@example.org or 10.240.0.1. After the LLM returns code containing user01@example.org, one click restores the real email. For developers who need AI to review code or debug SQL, this detail directly determines whether the tool is usable.

The essence of synthetic alias mode is "format-preserving masking": instead of replacing sensitive values with a uniform placeholder, it generates a stand-in that shares the original's semantic type, is syntactically valid, but has fictional content. This is done because downstream consumers are syntax-sensitive—the TypeScript compiler will reject {{EMAIL_1}} as an identifier outside a string literal, JSON Schema validation will fail because the placeholder doesn't match format: email, and SQL parsers may treat curly braces as illegal tokens. Using fake data like user01@example.org and 10.240.0.1 that reserve example domains and private address ranges passes type checking and schema validation while never accidentally pointing to real external resources. Implementation typically requires maintaining a "type—generator—reverse mapping table" triad to ensure lossless restoration after the LLM returns; the mapping table itself exists only in browser memory, further reducing the exposure surface.

Prompt Injection and Custom Regex

The "Prompt Formatting" tab automatically combines system instructions (for code review, contract negotiation, or log analysis) with the masked text, so the LLM knows not to modify these tokens. You can also inject custom regex rules on the fly, such as an internal employee ID format EMP-\d{5}. This lets the tool adapt to different teams' internal naming conventions.

The "prompt injection" here runs in the opposite direction of what the security field usually calls a prompt injection attack: it is defensive instruction injection, i.e., prepending a system-level instruction before user content that explicitly tells the model "the following tokens are placeholders—keep them as-is, do not rewrite or explain them." Because LLMs tend to polish and rewrite input, without explicit constraints the model might well change user01@example.org to another example address, causing reverse mapping to fail. Combining this instruction with the masked text into a fixed template effectively gives the model a stable output contract. Custom regex is another layer of extensibility: internal employee IDs, ticket numbers, and internal hostnames often don't match public rule libraries, and allowing on-the-fly injection of patterns like EMP-\d{5} lets the tool adapt to an organization's naming conventions without waiting for upstream rule set updates.

Command Line and Offline Pro Pack

For engineers who want to clean local source repositories or large log files directly from the terminal, the author released a Pro Pack, which includes a zero-dependency Python CLI (maskflow_cli.py), an offline Studio preloaded with 50+ US/JP regex rules, and an add-on tool called SchemaSlim AI—which extracts only type definitions from massive JSON/CSV payloads and is said to cut token consumption by up to 90%.

The web version is free to try without login and is suitable for quick daily masking; the Pro Pack targets batch processing and offline scenarios.

A zero-dependency Python CLI means the script uses only the Python standard library (such as re, argparse, pathlib) and requires no pip install of any third-party packages to run. For engineers who need to process logs in isolated environments, CI pipelines, or customer intranet machines, this is crucial: no dependencies means no supply chain risk and no version conflicts, and the script can be copied and executed directly. Combined with the offline Studio's local regex library, the entire chain—from reading source repositories and large log files to outputting masked results—produces no network traffic, complementing the web version's "data never leaves the browser" claim: the web version covers interactive daily masking, while the CLI and offline pack cover batch and restricted-network scenarios.

The Value and Boundaries of the Client-Side Approach

MaskFlow's core proposition is that data never leaves the browser. For developers who regularly handle production logs, customer data, and internal code, this is more reassuring than any cloud-based masking service. That said, it's worth noting that the ceiling of a pure client-side tool is limited by the accuracy of local regex and entropy detection—entropy detection may flag normal long strings as false positives, and custom rules require manual maintenance. The author solicits detection patterns and feature suggestions from the community at the end of the article, indicating that this rule library is still iterating.

If you work with LLMs every day and don't want to choose between privacy and efficiency, this kind of client-side tool is worth a bookmark.

One-line Summary

MaskFlow AI is a client-side privacy masking tool that runs entirely in browser memory, using Shannon entropy and synthetic aliases to protect keys and PII.

Paragraph Summary

MaskFlow AI is a client-side privacy tool that runs entirely in browser memory, designed to eliminate the tedious process of manually replacing API keys and PII before developers paste logs, code, and customer emails into LLMs. It uploads no data; sensitive information never leaves the device. Compared with simple regex replacement, v2.0 introduces three key designs: using Shannon entropy (threshold ≥3.85 bits/char) combined with character class transitions to identify unknown high-entropy tokens without fixed prefixes; using synthetic alias mode to generate syntactically valid fake data (such as user01@example.org) that avoids breaking TypeScript, JSON schema, or SQL; and automatically combining system instructions with custom regex so the model preserves placeholders and adapts to team-internal naming conventions. The author also released a Pro Pack, including a zero-dependency Python CLI, an offline regex library, and SchemaSlim AI, which can cut token consumption by up to 90%. The article also points out the boundaries of the pure client-side approach: entropy detection may produce false positives, and the rule library still requires manual maintenance and iteration.