Data Anonymization Workbench
Prepare a working copy of a table using an explicit policy for each column. This workbench combines removal, fixed and partial masking, consistent session pseudonyms and a before/after frequency check for up to four selected quasi-identifiers. It shows what changed without placing original values or headers in the policy report. The processed table itself can retain values you deliberately keep.
Key features
- Five explicit column policies with a masked default
- Stable exact-value pseudonyms within a column and memory session
- Fixed-marker partial masking by Unicode code points
- Before/after combination frequencies for up to four chosen columns
- Numeric policy audit without source values, headers or mapping dictionaries
- Complete processed CSV and a separate JSON policy report
How to use
- Paste CSV or select a UTF-8 file and choose its delimiter.
- Read columns; all columns initially use a fixed mask.
- Choose each column policy and optionally select up to four quasi-identifiers.
- Set the small-group threshold and apply the policies.
- Review the processed table, numeric audit and frequency limits before downloading the needed files.
Use cases
- Create a masked sample export for a software bug report
- Keep repeated customer labels consistent within a local review session
- Inspect how postcode masking changes selected group frequencies
- Record processing decisions without repeating original identifiers in the report
Frequently asked questions
Does the result guarantee anonymity?
No. Masking and pseudonyms do not prove that a table cannot be linked to outside information. The frequency check covers only the columns you selected in this table. It does not discover all identifiers, estimate an individual’s identification probability or decide legal compliance.
Are pseudonyms stable after changing the input?
Within the page session, the same exact value under the same exact column header receives the same token. Header and value comparisons do not trim, case-fold or normalize Unicode. Columns have separate mappings. Clear all, the example button, Reset pseudonyms or leaving the page start new mappings; mappings are never exported.
What does partial masking preserve?
It keeps the selected number of Unicode code points at the beginning and end and inserts a fixed three-dot marker. A value too short to hide at least one code point becomes [MASKED]. Code points are not grapheme clusters, so a combined emoji or accented letter may be split. Empty-string preservation is a separate checkbox; spaces are data.
How are small groups counted?
Rows with identical exact tuples in the chosen columns form a group, including empty cells. The report gives group sizes, singleton rows and rows in groups strictly smaller than your threshold k. Pseudonyms alone preserve equality and therefore do not enlarge groups. If every selected column is removed, the processed check is not evaluable rather than a successful anonymity result.
What is in the two downloads?
Processed CSV keeps the original retained column names and may include source values from Keep or Partial mask. Potential spreadsheet formulas receive a leading apostrophe in CSV only. The separate JSON policy report contains column ordinals, policies and numeric counts; it excludes names, original cell values, tuple values and mapping dictionaries. Neither preview pagination nor filtering truncates exports.
What are the limits and cancellation rules?
Input is limited to 1 MiB UTF-8, 5,000 data rows, 32 columns and 100,000 cells. Up to four quasi-identifiers and k from 2 to 20 are supported. Session mappings stop at 100,000 values, 2,000,000 stored UTF-16 units or 64 headers. Processing yields every 128 rows. Cancellation or input changes discard results, and cancelled mappings are not committed.
Privacy
CSV text, selected file contents, policies, mappings and results stay in this page’s memory. This tool does not put them into URLs, browser storage, analytics events or upload requests. Clear all and leaving the page discard its input and mapping state; Reset pseudonyms discards mappings while keeping the current input. Downloaded files are separate copies that you control.
Comments & questions