Redacted copy, ready for the AI
Hold Alt, or press and hold Show originals, to see the real details. The copied text is not changed.
With the real details
How it works
- Paste text into step 1, or open a .txt or .csv file. Each detail it finds is highlighted in the text and listed under Found. Untick a detail to leave it in.
- Copy the redacted text from step 2. Each detail is replaced by a numbered placeholder such as
[IRD_1]. The same detail always gets the same placeholder, so the AI can still tell people and accounts apart. - Paste the AI's answer into step 3. The placeholders turn back into the real details, ready to copy.
What it finds
NZ Redact looks for eleven kinds of New Zealand detail. Numbers that have a check digit are only flagged when the check digit is right, so order numbers and prices are left alone.
| Detail | How it is recognised | Example |
|---|---|---|
| IRD number | 8 or 9 digits with Inland Revenue's check digit | 49-098-576 |
| Bank account | Bank, branch, account and suffix with the published bank checksum | 01-0902-0068389-00 |
| NHI number | Both Health New Zealand formats, with the check character | ZAA0067 |
| Card number | 13 to 19 digits that pass the Luhn check | 4111 1111 1111 1111 |
| Driver licence | 2 letters and 6 digits after the word licence, or in a licence column | AB123456 |
| Passport number | Letters and digits after the word passport, or in a passport column | LA123456 |
| Date of birth | A date after DOB, born or birthday, or in a DOB column | 12/03/1985 |
| Email address | Any email address | sam@example.co.nz |
| Phone number | NZ mobiles, landlines, 0800 and +64 numbers | 021 123 4567 |
| Street address | A number, a street name and a street type, with suburb, city and postcode | 56 Hinemoa Street, Birkenhead |
| Name | After a label such as Name, Patient or Dear, in a name column, or signing off a message. Other likely names are marked possible. | Patient: Eru Waaka |
Accuracy
NZ Redact was tested blind on two sets of 30 New Zealand documents: emails, payroll notes, spreadsheet rows and support tickets. Both sets were written by an AI agent that was never shown the rules. For set 1 it wrote a script that fills each document with generated numbers and records every detail it puts in. For set 2 it wrote the documents and marked up the names itself. Text written by people is often messier, so treat these figures as a guide. These are the results as measured, including what it misses.
Set 1: the original 30 documents
| Measure | Result |
|---|---|
| Numbers, dates, emails, phones and addresses found | 0% |
| People's names found, counting possible names (0% in version 1.0) | 0% |
| Removed details that were real details | 0% |
| Look-alikes left alone, such as order numbers and wrong check digits | 0 |
Set 2: 30 documents about names, written for version 1.1
| Measure | Result |
|---|---|
| People's names found (0 of 0) | 0% |
| Removed names that were real names (0 were not) | 0% |
| Look-alike words left alone, such as places, months, and words like Will and May | 0 |
A name marked possible is a guess from the word itself, for example a common first name in a sentence. It is ticked, so it is removed, and you can untick it.
The results for the first set were known before the work on version 1.1 started. The rules were not tuned on its documents, but that is why the second set was written. It was written after the 1.1 rules were finished, by an AI agent that had not seen them, and it contains no numbers, emails or addresses, only names and look-alike words.
Set 1, by kind of detail
| Detail | In the documents | Found | Missed | False alarms |
|---|
While the rules were being built, a separate set of 80 documents was used to find gaps. On that set it found 0% of numbers, dates, emails, phones and addresses, and 0% of names. All three sets are in the repository, and npm run eval measures them again.
What it does not catch
- About a third of names. Most names are now found, but the ones missed are mostly names in ordinary sentences that are not common first names. Always read the redacted copy before you paste it, and use Remove this too for anything it missed.
- Health details, such as a diagnosis written in words.
- Numbers split across lines, or written in words.
- Company GST numbers and company bank accounts use the same check digits as personal ones, so they are removed too. That is on purpose: removing too much is safer than too little.
Use in code
The rules are a single JavaScript file with no dependencies. It works in the browser and in Node.js. Copy src/nz-redact.js from GitHub, where every rule and test is published under the MIT licence.
// Find the details and make the redacted copy
const found = NZRedact.scan(text);
const { text: safe, map } = NZRedact.redact(text, found);
// Later: put the details back into the AI's answer
const { text: answer } = NZRedact.restore(aiReply, map);Privacy
Nothing you paste is sent anywhere. The page's security policy blocks it from connecting to any server, and once it has loaded it also works offline.
There are no cookies and no tracking. If you pick a light or dark theme, that choice is saved in your own browser. The Ko-fi link opens Ko-fi's own site.