The Pain of Masking PII for LLMs — And Why I Built a 100% Client-Side Solution

As developers, founders, and power users, we use ChatGPT, Claude, and Gemini every single day to analyze error logs, review code, and draft emails.

But every time we paste our work, we face a painful, tedious ritual:

• Manually scrubbing API keys (sk_live_..., AIza...) and replacing them with xxxx.
• Masking client names, personal emails, and phone numbers one by one.
• And the worst part: Manually swapping all the xxxx placeholders back to the original production keys and names in the AI's response.

Sure, you could use cloud-based PII masking services, but sending sensitive code, internal logs, and customer emails to a third-party server defeats the whole purpose of privacy.

To solve this for myself (and fellow developers), I built MaskFlow AI — a 100% client-side privacy tool that runs entirely in your browser's memory. No network traffic, no server uploads, zero API keys sent anywhere.

🌐 Try it free instantly (No login required): MaskFlow AI Web App

---

Beyond Basic Regex: 4 Technical Features of MaskFlow v2.0

MaskFlow isn't just a simple string replacement script. Here is how it handles heavy-duty developer workflows:

1. Shannon Entropy ($H(X)$) Analysis for Unknown Secrets

Not all secrets have neat prefixes like sk_live_. MaskFlow calculates real-time Shannon entropy ($H(X) \ge 3.85 \text{ bits/char}$) and character-class transitions to automatically detect and mask high-entropy unknown tokens, displaying the entropy score (e.g., H=4.42b) in your mapping table.

2. Synthetic Alias Mode (Preserving LLM Code Accuracy)

Instead of generic placeholders like {{EMAIL_1}}, you can use valid syntax dummies like [e-mail] or 10.240.0.1. This prevents breaking TypeScript type checks, JSON schemas, or SQL queries when sending code to the LLM. When the AI returns code containing [e-mail], one click instantly reverts it back to your real email.

3. Prompt Injection & Custom Regex Builder

The "Prompt Formatting" tab automatically combines system instructions (tailored for code reviews, contract negotiations, or log analysis) with your masked text so the LLM knows not to alter the tokens. You can also inject custom regex rules on the fly (e.g., internal employee ID formats like EMP-\d{5}).

4. CLI & Offline Pro Pack for Power Users

For engineers who want to sanitize local source code repositories or large log files instantly from the terminal, I also released the Pro Pack. It includes:

• A zero-dependency Python CLI (maskflow_cli.py)
• An offline Studio pre-loaded with 50+ US/JP regex rules
• SchemaSlim AI: A bonus tool that extracts only type definitions from heavy JSON/CSV payloads to slash token consumption by up to 90%.

📦 Get MaskFlow AI Pro Pack: Gumroad

---

Give it a spin, bookmark it for your daily AI workflows, and let me know what detection patterns or features you'd like to see next! Feedback is always welcome. 🚀