 ┌─────────┐
 │ ████ ██ │
 │ ██ ████ │
 └────┬────┘
      │

mask2ai

Personal data stays on your machine when you talk to an AI.

Install

Claude Code

/plugin marketplace add serkankorkut/mask2ai
/plugin install mask2ai@mask2ai

claude.ai and ChatGPT in Chrome

Clone the repository, open chrome://extensions, turn on Developer mode, choose Load unpacked and pick the folder. Full steps.

What it does

Before a message, a file or a command result leaves your machine, mask2ai replaces every email, phone number, card number, IBAN, national ID, social security number, date of birth, name and street address it finds with a placeholder such as __PII_EMAIL_ae44b4__. The model only ever works with placeholders. On your screen, in your files and in the commands that run, the real values are put back.

Nothing is sent anywhere else. There is no server, no account and no dependency beyond Node.js.

Where it works

Claude Code CLI, as a plugin with six hooks: prompts, tool output, tool input and the on-screen reply.
claude.ai in Chrome, as an extension that rewrites the outgoing request in the page.
ChatGPT web in Chrome, same extension, same code.

The Chrome extension is called mask2ai, version 0.3.0. It is verified on claude.ai and chatgpt.com on every change by node demo/verify-web.js, which loads it into headless Chrome, sends a chat request from the page and checks that only placeholders leave the browser and that the page restores them.

Detection covers English and Turkish formats, with checksums for cards, IBANs and TC numbers.

See it

mask2ai in the Claude Code terminal: a prompt with an email is blocked, the masked prompt goes through, a CSV is read with 13 values masked, and the reply shows the real values restored on screen

The real Claude Code terminal with the plugin loaded. The prompt with an email is blocked and a masked copy is offered. The masked prompt goes through, the file read is masked before the model sees it, and the reply comes back with placeholders that are restored on screen.

Verify it

Do not take the page's word for it. The repository ships three checks.

npm test                  # detection, restoration, request rewriting
node demo/prove.js        # every byte Claude Code sends, captured and inspected
node demo/verify-web.js   # the extension on claude.ai and chatgpt.com, headless

The second starts a fake Anthropic API on localhost, points the real claude binary at it and asserts that a prompt with an email produces zero requests and that a file read arrives as placeholders only.

Limits

Detection is pattern based. Structured identifiers are matched reliably. Names and addresses are matched when a label, a title, a cue or a matching email is nearby; a bare name in free text is not. Health, religion or income stated in prose is not detected. Images are not inspected.