CSV PII scanner: find personal data in a lead file, then mask or hash it
In short: Classifies each column from its header and a sample of values: email, phone, name, postal address, date of birth, IP address, national ID (SSN, NI number), payment card (Luhn-checked), IBAN and social profile URL. Then each column is kept, masked, SHA-256 hashed or dropped in the file you share. Limit: Detection is by header and value patterns; it is a signal, not a legal classification.
A CSV PII scanner finds the columns that hold personal data before you share a file. Upload a lead list or export: each column is checked by its header and a sample of its values for emails, phone numbers, names, addresses, birth dates, IP addresses, national IDs and card numbers. Then choose keep, mask, hash or drop per column and download a safer copy.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
8 of 10 columns hold personal data: names, email, phone, address, date of birth and LinkedIn URLs.
- Personal data columns
- 8 of 10
- Hash
- DOB
- Drop
What this means for you
Keep, mask, hash or drop each before you share. A hash is still personal data under GDPR.
- Drop a CSV
- Emails, phones, names, IDs, cards
- Keep, mask, hash or drop
- Runs in your browser
- PII
- SHA-256
- GDPR
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Sharing a list for a campaign? Verify it first
- Keep the email column in plain text for the copy you verify, and hash or mask it only in the copy you hand to a vendor that doesn't send.
- Press Verify this list under the result, or upload the file at /verify; every address gets a live mailbox check without an email being sent.
How do I find and remove personal data from a CSV?
- Upload or paste the CSV with its header row.
- Press Scan for personal data. Each column shows what it looks like (email, phone, name, ID…) and how many sampled values match.
- Pick what happens to each column in the shared file: keep, mask (a***@domain, last two digits), hash (SHA-256) or drop. Sensitive kinds default to drop.
- Download the file to share. The original never leaves your browser.
Example
- You enter
- A 3-row lead CSV with First Name, Last Name, Email, Phone, Company, Street, Postcode, DOB, Notes and LinkedIn columns.
- You get
- 8 of 10 columns flagged: names and address (suggested mask), email and phone (suggested hash), date of birth and LinkedIn URL (suggested drop); Company and Notes show no pattern. The shared file downloads with Email_sha256 and Phone_sha256 columns, masked names and no DOB.
- Limits
- Runs in your browser with no row cap; an uploaded file can be up to 25 MB.
Is a phone number or email address personal data?
Under the GDPR, personal data is any information relating to an identifiable person. A named work email such as [email protected] is personal data; a phone number is too when it can be linked to someone, which is almost always the case in a lead list. A generic [email protected] usually isn't.
In US health care, a phone number or email tied to health information is one of HIPAA's 18 identifiers, so a patient list with phones is PHI. The scanner flags the columns; the legal call is yours.
Mask, hash or drop: which should I use?
Drop what the recipient doesn't need; it is the only option that removes the risk. Hash (SHA-256 of the trimmed, lower-cased value) when they need to match records against their own, such as an ad platform or a suppression check, because equal values give equal hashes. Mask when a person needs to recognise a row without reading it, for screenshots and support tickets.
A hash is still personal data under GDPR: anyone with the same email can compute the same hash, so it is pseudonymised, not anonymous. Treat a hashed file with the same care.
What each kind is detected by
| Kind | Header words | Value check |
|---|---|---|
| Email, phone | email, phone, mobile, tel | Address format; 7-15 digits |
| Name, address | first name, surname, street, postcode | Header first; UK postcodes, US ZIPs |
| Date of birth | dob, birth | Date formats |
| National ID | SSN, national insurance, passport | 123-45-6789; UK NI format |
| Card, IBAN | card number, iban | Luhn checksum; IBAN shape |
Who uses this tool, and for what?
- Agencies
- Check a client's lead file for card numbers, birth dates or IDs before it goes into a shared drive.
- Data vendors
- Hash the email and phone columns of a file sent for matching, and drop the rest.
- Clinics
- Spot patient phone and email columns before a list reaches a marketing contractor.
What can’t this tool tell you?
- Detection is by header and value patterns; it is a signal, not a legal classification.
- Free-text columns can contain personal data that no pattern finds.
- Names and addresses are found mainly by header; an unnamed column of names may be missed.
- National ID checks cover US SSNs and UK National Insurance numbers only.
Common questions
- Is a phone number PII?
- Yes, when it can identify a person, which a mobile or direct line in a lead file does. It is personal data under GDPR, and PHI when it sits next to health information.
- Does hashing make the data anonymous?
- No. SHA-256 of an email can be recomputed by anyone who has the email, so hashed data is pseudonymised and still personal data under GDPR.
- Can it miss personal data?
- Yes. Free-text columns such as notes can hold names, numbers and health details that no column pattern sees. Read those before sharing.
- Is my file uploaded?
- No. Scanning, masking and hashing all run in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.