How to mask PII in logs

What counts as PII in a log

PII (personally identifiable information) is anything that points to a person on its own or together with other data. In application logs it shows up in a few predictable places:

• Email addresses in login, signup, password reset and billing messages, and as user identifiers in structured logs.
• IP addresses in web server access logs, X-Forwarded-For headers, and rate limiting or fraud messages.
• Card numbers and IBANs in payment errors, webhook dumps and request bodies logged at debug level.
• Phone numbers in SMS, two factor and support flows.
• Names, street addresses and dates of birth in profile updates, orders and shipping.
• User IDs, session IDs and device IDs, which may not identify anyone alone but tie every other line to one person.

Under the GDPR, an email address or an IP address is personal data when it can be linked to a person, and for your own users it usually can. That matters the moment a log leaves the system that wrote it: pasted into a GitHub issue, attached to a vendor ticket, dropped in a team chat or sent to an AI assistant. Each copy is one more place that holds your users' data, with its own retention and access rules.

Example: a log with PII, before and after

Before highlights what PasteSafe finds. After is the exact output of PasteSafe's scanner on that text.

2026-09-15T09:41:07Z INFO  login ok user=jane.doe@example.com ip=203.0.113.9
2026-09-15T09:41:09Z ERROR charge failed for jane.doe@example.com card=4242 4242 4242 4242
2026-09-15T09:41:09Z WARN  refund to IBAN GB82 WEST 1234 5698 7654 32, callback +1 415 555 0132
2026-09-15T09:41:10Z INFO  X-Forwarded-For: 198.51.100.7, 192.0.2.44
2026-09-15T09:41:11Z INFO  profile update name="Jane Doe" dob=1990-04-12 email=jane.doe%40example.com
2026-09-15T09:41:12Z INFO  sms fallback to 415.555.0132 from 127.0.0.1

2026-09-15T09:41:07Z INFO  login ok user=EMAIL_1 ip=IP_1
2026-09-15T09:41:09Z ERROR charge failed for EMAIL_1 card=CARD_1
2026-09-15T09:41:09Z WARN  refund to IBAN IBAN_1, callback PHONE_1
2026-09-15T09:41:10Z INFO  X-Forwarded-For: IP_2, IP_3
2026-09-15T09:41:11Z INFO  profile update name="Jane Doe" dob=1990-04-12 email=jane.doe%40example.com
2026-09-15T09:41:12Z INFO  sms fallback to 415.555.0132 from 127.0.0.1

Every email, IP address, card number, IBAN and international phone number is replaced. The same email gets the same placeholder on every line, so you can still follow one customer through the log. The last two lines show what stays: the name, the date of birth, the URL encoded email, the phone number written with dots and the loopback address.

How to mask PII in a log with PasteSafe

1. Open PasteSafe and paste the log, or drop the log file onto the editor. The file is read on your device.
2. Emails become EMAIL_1, IP addresses IP_1, card numbers CARD_1, IBANs IBAN_1 and phone numbers PHONE_1. API keys, tokens and passwords are masked in the same pass.
3. Check the Findings list. If you need the IP addresses to debug a network problem, untick IP addresses under Mask these and they stay in the text.
4. Read the cleaned text for anything a scanner cannot know is personal, such as names.
5. Copy the cleaned text and share it. If an AI assistant answers with placeholders, paste its reply into Put the real values back to swap the real values in again, in your browser.

The scan runs in a Web Worker inside the page, and the page's Content Security Policy blocks network connections, so the log is not uploaded anywhere.

Masking PII on the command line

For a quick one off with GNU sed, these two expressions replace email addresses and IPv4 addresses:

sed -E 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/EMAIL/g; s/\b([0-9]{1,3}\.){3}[0-9]{1,3}\b/IP/g' app.log > app.masked.log

It works, with limits. Every address becomes the same EMAIL, so you can no longer tell two users apart. The IP pattern also hits version strings like 1.2.3.4. And there is nothing for card numbers, which need a Luhn check to avoid masking every long order number.

If you only need to hide which host a request came from, keep the network and zero the last octet:

sed -E 's/\b([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\.[0-9]{1,3}\b/\1.0/g' access.log > access.masked.log

The sed that ships with macOS does not support \b. Install GNU sed, or use perl -pe, which understands the same patterns.

Stop writing PII into logs

Masking a copy fixes one paste. For logs your services write every day, fix it at the source:

• Log a user ID instead of an email address. Support can look the user up when they need to.
• Never log full card numbers. If you need to tell cards apart, log the brand and the last four digits.
• Decide how long access logs with IP addresses are kept, and truncate or drop the address where you do not need it.
• Add redaction to your logger, so fields like email, password and authorization are replaced before anything is written. The guide on masking sensitive data in logs has examples for Node, Python, Java and Go.

What PasteSafe does not catch

PasteSafe looks for data with a recognizable shape. It does not mask:

• Names, street addresses, dates of birth, and national ID numbers such as US Social Security numbers.
• URL encoded emails like jane.doe%40example.com.
• Phone numbers in local formats without a country code, or written with dots. It matches international numbers starting with + and US numbers like (415) 555-0132 or 415-555-0132.
• Card numbers that fail the Luhn check, and loopback addresses such as 127.0.0.1, which it skips on purpose.
• User IDs, hostnames and anything else that is only personal in context.

Read the cleaned text before you share it.