Guide
How to Anonymize a Data File Before You Share It
Somebody needs a copy of the file. Not the whole thing — just enough to test against, or to check a number, or to send to an agency. And the file has customers in it.
The short answer
Find the personal data first, then transform it column by column. In DataTray, open Clean & Anonymize: the scan flags likely personal-data columns — emails, phone numbers, national IDs, payment cards, IBANs, IP addresses, dates of birth, addresses and names — each with a confidence level and a count of matching rows. You confirm what is actually personal, choose what to do with each column, and run it once. A modified copy is written; your original is untouched.
What gets detected, and how
Detection is deterministic — patterns plus checksum validation, which is what keeps the false-positive rate low enough to be usable:
| Found | How |
|---|---|
| Pattern plus a TLD sanity check | |
| Phone | E.164 and common national formats |
| National ID | Structural rules, e.g. US SSN area and group validity |
| Payment card | Luhn check — so a 16-digit order number is not flagged |
| IBAN | mod-97 check |
| IP address | v4 and v6 |
| Date of birth | A date column whose distribution looks like birthdays |
| Postal address | A shape heuristic, and labelled as one |
| Person name | Dictionary match, labelled low-confidence |
The Luhn check is the difference between a tool you can use and one you cannot. Without it, every long numeric identifier in your file gets flagged as a credit card and you stop reading the findings.
Five things you can do to a column
- Redact — replace with
████. Simple, and destroys the column's usefulness, which is sometimes exactly right. - Mask partially —
j••••@acme.com,••••1234. Keeps the value recognisable to someone who already knows it while not disclosing it to someone who does not. - Hash — SHA-256, optionally salted. Equal values stay equal, so counts and joins survive, but the original cannot be read back.
- Tokenize — a stable pseudonym per distinct value.
CUST_0001. This is the one to use when the recipient still needs to join on the column. - Generalize — reduce precision instead of removing it. A date becomes a year, a postcode becomes its first three characters, an age becomes a band. Often the best trade: analytically useful, individually not identifying.
Record the salt, or the output is useless
If you hash with a salt, DataTray shows the salt and saves it with the run.
This matters more than it sounds. An unrecorded salt means next month's export hashes the same customer to a different value, so the two files cannot be joined and nobody notices until somebody tries. It is a small operational detail that quietly ruins a dataset, so it is surfaced rather than handled invisibly.
Send a sample, not the file
Often the real requirement is not an anonymized copy of everything — it is a representative slice.
Take n rows or n%, optionally stratified by a column so the distribution is preserved, and
optionally anonymized in the same pass. "I need to send somebody a representative piece of this
file without sending the file" is a weekly job, and it is one operation.
What this is not
Worth being direct, because the tile is called Anonymize and the word carries more weight than it should.
This finds and masks personal data. It does not certify a file as anonymous. The rules can miss personal data that is present — anything in a free-text column, anything in a format not covered — and can flag values that are not personal. Name detection is explicitly low-confidence, and is labelled that way in the findings.
More fundamentally, whether a file is anonymous is not a property of the columns you masked. It depends on what remains and what it could be combined with: a masked name column beside an exact postcode, date of birth and job title may still identify one person. That judgement is yours, and it is a judgement no scan can make for you.
What the tool gives you is the finding, the count, the transformation, and a report stating what was changed and — the part a reviewer needs — what was deliberately left untouched.
Nothing leaves the machine
Detection is regex and checksums over column statistics, computed locally in milliseconds. No model, no API key, no service. The file you are anonymizing is by definition the file you least want to upload, which is the whole reason this runs where it does.
Every other free way to do this asks you to upload the file first — which is a remarkable thing to ask of somebody trying to remove personal data before sharing it.
Do this in one pass with — Clean & Anonymize
Trailing whitespace, dates in four formats, numbers stored as text, the leading zeros that vanished, encoding that turned é into é. DataTray finds them without being asked and fixes them in one previewable stack of operations — and in the same pass it finds the personal data, so you can mask, hash or tokenize it before the file goes anywhere. Every finding is a deterministic rule over the column, explainable in one sentence. No model, no API key, nothing uploaded. Learn more about the Clean & Anonymize.
Windows 10/11 (x64) · Free · No account