Library of regex patterns for detecting SSNs, credit cards, API keys, passwords, and PII in text. Test patterns on sample data.
A reference library of regular expressions for the data shapes that leak most: Social Security numbers, credit card numbers, API keys, passwords, and other personally identifiable information. You pick a category, read the pattern, and paste sample text to see every match highlighted with a count. All matching runs in the browser against the text in front of you, so you can scan real-looking data without sending it anywhere. The thing users most often get wrong: a match proves format, not validity. The pattern recognizes a string that looks like an SSN or a card; it cannot tell you whether the number is real.
A concrete input and expected output from the current implementation.
Input
Customer 123-45-6789 called about order 555-12-3456; ticket 99-1234 was filed.
Expected output
2 matches: 123-45-6789 and 555-12-3456
The SSN pattern \b\d{3}-\d{2}-\d{4}\b requires exactly three digits, a hyphen, two digits, a hyphen, then four digits, with word boundaries on each side. Both flagged strings have that shape; 99-1234 has only two digits before its hyphen, so it cannot be consumed, and the second match shows the pattern cannot tell a phone-style number from an SSN.
The library is organized by data type, not by use case. Each entry pairs a prewritten pattern with example strings that should and should not match, so the pattern's format assumptions are visible before you use it. Pasting text runs the selected pattern across the whole input and marks every occurrence; switching categories re-runs the same text immediately, which makes comparing coverage across data types a one-click operation.
The regex engine reports every place a sequence of digits, dashes, and letter runs fits the selected pattern. Nothing consults a registry of issued numbers, so a match means 'this text has the shape of a credit card', not 'this is a real card'. The reverse gap matters too: formats the pattern does not include, such as an SSN written without dashes, pass through unreported.
No. The pattern matching runs entirely in the browser on your machine; nothing you paste is uploaded, which is exactly why the tool can accept text containing real-looking SSNs and card numbers without asking you to scrub it first. The usual judgment still applies: do not paste live secrets into any web page you would not otherwise trust.
Both answers are the same: the regex matches character shape, not meaning. A 10-digit number with hyphens in the right places matches the SSN pattern whether it is a phone number or not, and an SSN written without dashes matches nothing unless the pattern for that category includes a grouped form. Check the pattern's format assumptions before you trust a negative result.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.