Everything ScrubLocally can find in your text

30 detectors, 27 of them on by default. Each one is a pattern, often paired with a checksum, running in your browser. This page lists all of them with the honest version of what they catch — including the ones that are deliberately conservative, because a detector that redacts every long number makes documents unusable and gets switched off.

People & organisations

Detector	Default	What it matches, and what it doesn’t
Names	on	Given names from a common-name list, titles (Dr, Ms), sign-offs and “my name is …”. Heuristic: unusual names need the custom-terms box.
Email addresses	on	Any RFC-shaped address, including plus-tagged and subdomained ones.
Phone numbers	on	US/NANP formats and +country international numbers, with or without separators.
Usernames / @handles	on	@mentions on social platforms, Slack and GitHub.
Company names	on	Names ending in Inc, LLC, Ltd, GmbH, Corp and friends. Plain brand names need custom terms.
Your custom terms	on	Anything you type in the custom-terms box — project codenames, internal product names, a nickname.

Government & health IDs

Detector	Default	What it matches, and what it doesn’t
US Social Security numbers	on	Dashed SSNs always; bare 9-digit runs only next to an “SSN”/“social security” label. Never-issued ranges are ignored.
Dates of birth	on	Dates labelled DOB / date of birth / born on.
All dates	off	Every date in the text. HIPAA Safe Harbor needs this; ordinary writing usually does not.
Passport numbers	on	Only where a “passport” label is next to the number — passport formats vary too much to guess.
Driver’s licence numbers	on	Label-anchored (“DL #…”). US state formats are inconsistent, so context is required.
Medical record numbers	on	MRN / patient ID / chart number labels and the value after them.
UK National Insurance	on	QQ 12 34 56 A format, excluding the letter combinations HMRC never issues.
Aadhaar numbers (India)	on	12 digits that pass the Verhoeff check digit.
PAN (India)	on	The AAAAA9999A income-tax PAN format.
NHS numbers (UK)	off	Off by default: a valid NHS number is 10 digits and looks exactly like a US phone number.

Financial

Detector	Default	What it matches, and what it doesn’t
Card numbers	on	Luhn-valid 13–19 digit numbers on a known card prefix — so order IDs are not mistaken for cards.
IBANs	on	Checked with the ISO 13616 mod-97 rule, so lookalikes are skipped.
US routing numbers	on	Nine digits that pass the ABA checksum, next to a routing/ABA label.
Account & reference IDs	on	Values after account / customer / policy / invoice / case labels.
Crypto wallet addresses	on	Bitcoin (legacy and bech32) and Ethereum-style addresses.

Technical & secrets

Detector	Default	What it matches, and what it doesn’t
API keys & secrets	on	OpenAI, Anthropic, AWS, GitHub, Google, Stripe, Slack, Twilio, SendGrid, GitLab, Hugging Face keys plus generic key/password assignments.
Private key blocks	on	Whole PEM blocks, from BEGIN to END.
JWT / bearer tokens	on	Three-part JSON Web Tokens, which usually carry a user ID in the payload.
IP addresses	on	IPv4 and IPv6. Handy for logs; turn it off if you are debugging network config.
MAC addresses	on	Hardware addresses in colon or dash form.
URLs	off	Off by default — links are usually the context the model needs. Turn on for signed or tokenised URLs.

Location

Detector	Default	What it matches, and what it doesn’t
Street addresses	on	House number + street name, with an optional unit, city, state and ZIP.
Postcodes	on	US state + ZIP pairs and UK postcodes standing on their own.
GPS coordinates	on	Decimal latitude/longitude pairs.

The checksums, and why they matter

Five detectors verify their matches with arithmetic rather than trusting the shape. Card numbers must pass the Luhn (mod-10) check and begin with an issuer prefix that exists under ISO/IEC 7812 — Visa 4, Mastercard 51–55 and 2221–2720, American Express 34 and 37, Discover 6011 and 65, JCB, Diners and UnionPay. IBANs must satisfy the ISO 13616 mod-97 rule. US routing numbers must pass the ABA 3-7-1 weighted checksum. Aadhaar numbers must pass the Verhoeff check digit; NHS numbers, the mod-11 digit.

The payoff is precision. Without those checks, a sixteen-digit order number, a twelve-digit reference and a nine-digit part code would all be redacted, and the text you handed to a model would be missing exactly the identifiers you needed it to reason about.

What no detector here can do

It cannot recognise a name it has never seen with no title in front of it. It cannot tell that “the client from the Tuesday call” is a person. It cannot see identity that comes from combination — a job title plus a city plus a date is often unique even with every name removed, which is why HIPAA pairs its identifier list with an “actual knowledge” condition and FERPA asks whether a reasonable person could still identify the student.

Which is why the tool highlights instead of just replacing. Read the coloured left pane before you paste; the review takes seconds and it is the only part of this process that a pattern matcher genuinely cannot do for you.

Frequently asked questions

Why are some detectors off by default?

Because they collide with ordinary text or with each other. Every date is an identifier under HIPAA Safe Harbor but a nuisance in business writing. A valid NHS number is ten digits and indistinguishable from a US phone number. URLs are usually the context a model needs. Each of those is one click away in the settings panel, and several pages here turn them on for you.

What is the difference between a detector and a custom term?

A detector recognises a shape — an email address, a Luhn-valid card number, a street address. A custom term is a literal string you type: a codename, an unusual surname, an internal system. Custom terms are matched case-insensitively on word boundaries and are never stored.

Do you use an AI model to detect personal data?

No. Everything here is deterministic pattern matching plus checksums, which is why it runs instantly, works offline and never sends anything anywhere. A small on-device NER model would find more unusual names at the cost of a multi-megabyte download; the trade was made in favour of speed, and the custom-terms box covers the gap.