Text anonymization sounds like a big privacy-engineering task, but the first version can be surprisingly simple.

If your app stores logs, user messages, support tickets, form submissions, analytics events, or AI prompts, you may need to remove personal details before that text moves into another system. That can mean replacing names, emails, phone numbers, credit card numbers, IP addresses, or IDs with safe placeholders.

In this quick guide, we’ll build a small JavaScript anonymizer that replaces common personally identifiable information, or PII, with labels like [EMAIL], [PHONE], and [CARD].

This will not replace a full privacy platform. It gives you a fast working base that you can improve with stronger rules, NLP-based detection, human review, or tools like Microsoft Presidio, which supports PII detection and anonymization for text, images, and structured data.

What we’ll build

We’ll create a simple JavaScript function that takes this:

Hi, my name is Sarah Miller. Email me at [email protected] or call +1 (312) 555-9821. My card is 4111 1111 1111 1111.

And returns this:

Hi, my name is [NAME]. Email me at [EMAIL] or call [PHONE]. My card is [CARD].

The goal is simple:

PII type	Replacement
Email address	[EMAIL]
Phone number	[PHONE]
Credit card number	[CARD]
IP address	[IP_ADDRESS]
Social Security number	[SSN]
Simple full name pattern	[NAME]

JavaScript makes this easy with regular expressions and String.prototype.replace(), which returns a new string with matched patterns replaced by another value, according to MDN’s JavaScript docs.

Step 1: Create the anonymizer

Here is a small version you can paste into a Node.js file or browser console.

function anonymizeText(text) {
  return text
    // Email addresses
    .replace(
      /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
      "[EMAIL]"
    )

    // US-style phone numbers
    .replace(
      /(\+?\d{1,2}[\s.-]?)?(\(?\d{3}\)?[\s.-]?)\d{3}[\s.-]?\d{4}/g,
      "[PHONE]"
    )

    // Credit card-like numbers
    .replace(
      /\b(?:\d[ -]*?){13,19}\b/g,
      "[CARD]"
    )

    // US Social Security numbers
    .replace(
      /\b\d{3}-\d{2}-\d{4}\b/g,
      "[SSN]"
    )

    // IPv4 addresses
    .replace(
      /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
      "[IP_ADDRESS]"
    )

    // Simple full-name pattern
    .replace(
      /\b[A-Z][a-z]+ [A-Z][a-z]+\b/g,
      "[NAME]"
    );
}

Now test it:

const input = `
Hi, my name is Sarah Miller.
Email me at [email protected].
Call me at +1 (312) 555-9821.
My card is 4111 1111 1111 1111.
My SSN is 123-45-6789.
My IP is 192.168.0.1.
`;

console.log(anonymizeText(input));

Output:

Hi, my name is [NAME].
Email me at [EMAIL].
Call me at [PHONE].
My card is [CARD].
My SSN is [SSN].
My IP is [IP_ADDRESS].

That is the basic version.

Step 2: Make it easier to extend

The first version works, but it is messy to maintain. A cleaner approach is to keep patterns in one array.

const piiPatterns = [
  {
    label: "EMAIL",
    regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi
  },
  {
    label: "PHONE",
    regex: /(\+?\d{1,2}[\s.-]?)?(\(?\d{3}\)?[\s.-]?)\d{3}[\s.-]?\d{4}/g
  },
  {
    label: "CARD",
    regex: /\b(?:\d[ -]*?){13,19}\b/g
  },
  {
    label: "SSN",
    regex: /\b\d{3}-\d{2}-\d{4}\b/g
  },
  {
    label: "IP_ADDRESS",
    regex: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g
  },
  {
    label: "NAME",
    regex: /\b[A-Z][a-z]+ [A-Z][a-z]+\b/g
  }
];

function anonymizeText(text) {
  return piiPatterns.reduce((result, pattern) => {
    return result.replace(pattern.regex, `[${pattern.label}]`);
  }, text);
}

This version is easier to update. If you want to detect passport numbers, account numbers, order IDs, or employee IDs, add another object to piiPatterns.

Step 3: Keep a map for reversible anonymization

Sometimes you need consistent fake labels.

For example, if Sarah Miller appears five times, you may want every mention to become [NAME_1], not just [NAME].

That helps with debugging, AI prompts, conversation analysis, and support workflows.

function createAnonymizer() {
  const entityMap = new Map();
  const counters = {};

  function getReplacement(label, value) {
    const key = `${label}:${value}`;

    if (!entityMap.has(key)) {
      counters[label] = (counters[label] || 0) + 1;
      entityMap.set(key, `[${label}_${counters[label]}]`);
    }

    return entityMap.get(key);
  }

  function anonymize(text) {
    let result = text;

    for (const pattern of piiPatterns) {
      result = result.replace(pattern.regex, (match) => {
        return getReplacement(pattern.label, match);
      });
    }

    return result;
  }

  return { anonymize, entityMap };
}

Test it:

const { anonymize, entityMap } = createAnonymizer();

const message = `
Sarah Miller emailed [email protected].
Later, Sarah Miller called from +1 (312) 555-9821.
`;

console.log(anonymize(message));
console.log(entityMap);

Output:

[NAME_1] emailed [EMAIL_1].
Later, [NAME_1] called from [PHONE_1].

This is useful when you need consistency while still hiding the original values.

Step 4: Use it before logs or AI prompts

A common use case is protecting logs.

OWASP’s Logging Cheat Sheet warns against logging sensitive personal data, access tokens, passwords, bank data, secrets, and similar information.

You can anonymize text before writing it to logs:

function safeLog(message) {
  console.log(anonymizeText(message));
}

safeLog("User [email protected] failed login from 192.168.0.1");

Output:

User [EMAIL] failed login from [IP_ADDRESS]

You can also use it before sending text into an AI workflow:

async function preparePrompt(userText) {
  const cleanText = anonymizeText(userText);

  return `
Summarize this support request:

${cleanText}
`;
}

This helps reduce the chance of sending raw PII into third-party tools, logs, analytics platforms, or LLM calls.

Step 5: Know the limits

Regex anonymization is fast, cheap, and easy to understand. It also has limits.

What regex handles well	What regex struggles with
Emails	Names in unusual formats
Phone numbers	Addresses
SSNs	Nicknames
Credit card-like numbers	Company-specific IDs
IP addresses	Context-dependent PII
Simple patterns	Multilingual text
Fixed identifiers	Misspellings and messy input

For example, the simple name regex may catch Sarah Miller, but it may miss Dr. Sarah J. Miller, SARAH MILLER, Iryna Pylypchuk, or names in non-Latin scripts. It may also replace phrases that are not names, such as Project Apollo.

That is why production anonymization often combines:

Method	Use
Regex	Emails, phone numbers, IDs, fixed patterns
Dictionaries	Known names, locations, terms
NLP models	People, places, organizations
Checksums or hashing	Stable pseudonymous IDs
Human review	High-risk data
Allow/block lists	Business-specific rules
Privacy tools	Presidio, DLP tools, cloud privacy APIs

A 2025 paper on PIIvot also points out that real PII anonymization has a recall and precision tradeoff. In plain English: a detector can miss private data, or it can over-mask harmless text. The right balance depends on the data and the risk.

Better production pattern

For a real app, use a layered workflow.

If the text goes into an LLM workflow, you can place anonymization before the model call:

User input ⟶ Anonymize with JavaScript ⟶ Send clean prompt to LLMAPI ⟶ Route to the best model ⟶ Store response without raw PII

This is useful for support apps, chatbots, analytics tools, document processing, HR tools, healthcare intake, and customer feedback systems.

Full copy-paste example

Here is the full 5-minute version:

const piiPatterns = [

  {

    label: "EMAIL",

    regex: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi

  },

  {

    label: "PHONE",

    regex: /(\+?\d{1,2}[\s.-]?)?(\(?\d{3}\)?[\s.-]?)\d{3}[\s.-]?\d{4}/g

  },

  {

    label: "CARD",

    regex: /\b(?:\d[ -]*?){13,19}\b/g

  },

  {

    label: "SSN",

    regex: /\b\d{3}-\d{2}-\d{4}\b/g

  },

  {

    label: "IP_ADDRESS",

    regex: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g

  },

  {

    label: "NAME",

    regex: /\b[A-Z][a-z]+ [A-Z][a-z]+\b/g

  }

];

function anonymizeText(text) {

  return piiPatterns.reduce((result, pattern) => {

    return result.replace(pattern.regex, `[${pattern.label}]`);

  }, text);

}

const input = `

Sarah Miller emailed [email protected].

Call her at +1 (312) 555-9821.

Card: 4111 1111 1111 1111.

SSN: 123-45-6789.

IP: 192.168.0.1.

`;

console.log(anonymizeText(input));

Final thoughts

You can anonymize basic text in JavaScript with a few regex rules and replace(). That is enough for a quick prototype, simple logs, demos, and low-risk internal tools.

For production, add stronger detection, review rules, and privacy controls. Tools like Microsoft Presidio can help with more advanced PII detection and anonymization, while JavaScript can still handle fast preprocessing at the app layer.

If anonymized text moves into AI workflows, connect the clean text to LLMAPI so your app can route prompts across models, track cost, and reduce the risk of sending sensitive raw text into every provider.