mask2ai
Personal data stays on your machine when you talk to an AI.
Protects your privacy when you use ChatGPT, claude.ai or Claude Code, as a Chrome extension and a Claude Code plugin. Names, numbers and addresses become placeholders before they leave. You keep seeing the real values.
From the Chrome Web Store. Then open claude.ai or chatgpt.com and look for the "mask2ai: on" toast. Chrome 111 or newer. Details
> /plugin install mask2ai --marketplace serkankorkut/mask2aiType it in a Claude Code session, confirm the source and choose the user scope. Needs Node.js 18 or newer and Claude Code 2.1.275 or newer. Details
What does mask2ai do?
It masks before anything leaves.
A prompt, a file read, a command result. Each one is scanned on your machine and every email, phone number, card, IBAN, national ID, social security number, date of birth, name and street address is replaced with a placeholder.
In Claude Code a prompt with personal data is stopped before it is sent and the masked copy is put in your clipboard. In Chrome the request is rewritten in the page before it goes out.
❯ Email jane.doe@example.com and tell her invoice 1042 is overdue mask2ai: personal data found in your prompt, nothing was sent. A masked copy is in your clipboard, paste it to resend: ❯ Email __PII_EMAIL_ae44b4__ and tell her invoice 1042 is overdue
It restores what you need to see and run.
The model works with placeholders and writes them back into its replies, its file edits and its shell commands. mask2ai swaps the real values back in on your screen, in the edit before it is applied, and in the command before it runs.
Edits match the real file. Commands run with real arguments. You never read a placeholder unless you look at the raw transcript.
Read customers.csv mask2ai: masked 13 values in Read output model sees 1,__PII_NAME_464c3e__,__PII_NAME_b37bc4__,__PII_EMAIL_ae44b4__,… you see 1,Jane,Doe,jane.doe@example.com,… model writes sed -i s/__PII_EMAIL_ae44b4__/billing@acme.com/ what runs sed -i s/jane.doe@example.com/billing@acme.com/
It checks, it does not guess.
Card numbers must pass Luhn, IBANs mod 97, Turkish ID numbers their checksum. Timestamps, version strings, private IP addresses and package names are left alone.
Names and addresses are matched when there is a signal nearby: a title, a label, a cue like "my name is", or the email that belongs to the person. English and Turkish formats.
4111 1111 1111 1111 card Luhn ✓ → __PII_CARD_14a1a1__ TR33 0006 1005 1978… IBAN mod 97 ✓ → __PII_IBAN_d9af0e__ 11111111110 TC no checksum ✓ → __PII_TCKN_f0e30d__ 111-11-1111 SSN → __PII_SSN_7410e4__ Dr. Jane Doe name title ✓ → Dr. __PII_NAME_…__ 1758200000000 timestamp left alone 192.168.1.10 private IP left alone
It works in Chrome too.
The same detection runs inside claude.ai and chatgpt.com as an extension. It rewrites the outgoing chat request in the page, JSON or form-encoded, plain or gzip-compressed, and restores placeholders in the rendered reply.
A toast tells you how many values were masked each time you send. The placeholder map lives in the tab and disappears when you close it.
chatgpt.com POST /conversation/updates prompt=Write a note to __PII_EMAIL_ae44b4__ confirming her details: phone __PII_PHONE_ddab37__, SSN __PII_SSN_7410e4__, TC kimlik no __PII_TCKN_f0e30d__ 🛡 mask2ai: masked 4 values before sending
It handles files, not just text.
In Claude Code a PDF read is redirected to a masked text extraction, so the raw PDF is never read by the model. An image read is redirected to a copy where the words that match, found by OCR, are blacked out in the pixels. A file that cannot be inspected is withheld rather than sent.
In Chrome, Word, Excel and PowerPoint uploads are rewritten inside the file, so formatting and images stay intact and only the text changes. Text files too. PDF and image uploads in the browser are not inspected, and a toast says so.
Read customer.pdf mask2ai: converted PDF to text and masked 4 values Name: __PII_NAME_3490d3__ Email: __PII_EMAIL_ae44b4__ Read customer.png mask2ai: redacted 4 values in the image OCR of what was sent: Customer record | Name: █████ | Email: █████ chatgpt.com upload contact.docx 🛡 mask2ai: masked 3 values in an uploaded file
It never phones home.
No server, no account, no telemetry, no dependency beyond Node.js. The hooks are child processes; the extension is three scripts in the page.
Do not take this page's word for it. The repository ships a proof that starts a fake Anthropic API on localhost, drives the real Claude Code binary against it and inspects every byte it sends.
$ node demo/prove.js 1. prompt containing personal data blocked by the hook, API requests made: 0 2. tool output containing personal data placeholders on the wire: 14 personal data on the wire: none PROOF OK: nothing personal reached the API, only placeholders.
Emails and phones
International, US, UK and Turkish phone formats.
Cards and IBANs
Validated with Luhn and mod 97 before masking.
National IDs and SSNs
Turkish ID numbers with checksum, US social security numbers, passport and ID numbers after a label.
Names and addresses
After a title, a label or a cue, or derived from a masked email. US, UK and Turkish street shapes.
PDFs, images and Office files
PDF to masked text and image redaction in Claude Code, natively on macOS and with poppler, tesseract and ImageMagick on Linux. Word, Excel, PowerPoint and text uploads masked in place in Chrome.
Open source
MIT licensed, one detection core shared by the plugin and the extension, tests in CI.
Questions
What does mask2ai do to what I type into ChatGPT?
A tool that removes personally identifiable information, PII for short, from what you send to ChatGPT. mask2ai does this with PII masking: each value becomes a placeholder before the message leaves your browser, and the real value comes back in the reply on your screen. It runs locally, with no server in between.
How do I stop sending personal data to ChatGPT?
Install the mask2ai Chrome extension. Before a message leaves chatgpt.com or claude.ai, it replaces names, emails, phone numbers, card numbers, IBANs and national IDs with placeholders such as __PII_EMAIL_ae44b4__. ChatGPT only sees the placeholders. The reply on your screen shows the real values. The full guide.
Does it work with Claude Code?
Yes. mask2ai is a Claude Code plugin. Install it with /plugin marketplace add serkankorkut/mask2ai and /plugin install mask2ai@mask2ai. It masks personal data in prompts and in tool output, such as files and command results, before they reach the model, and restores the real values in tool calls and on screen. What Claude Code sends, and how to keep it out.
Is Claude Code safe to use with sensitive data?
Claude Code sends everything it reads to the API: prompts, file contents, command output and tool results. With customer data in your repository, that includes names, emails and account numbers. mask2ai masks that sensitive data in the Claude Code hooks before it leaves your machine. What Claude Code sends.
How do I anonymize data before sending it to an AI?
Replace each personal value with a consistent placeholder, send that, and map the placeholders back in the answer. Strictly this is pseudonymisation, and it is what mask2ai does automatically. The map stays on your machine, so you do not have to redact by hand.
Does mask2ai send my data to a server?
No. Detection and restoration run on your machine. There is no server and no account. The placeholder map stays local and is deleted when the Claude Code session ends or the browser tab closes.
What personal data does it detect?
Emails, phone numbers, payment cards with a Luhn check, IBANs with a mod 97 check, Turkish ID numbers, US social security numbers, dates of birth, passport and ID numbers after a label, public IP addresses, and names and street addresses when a label, title or cue is nearby. English and Turkish formats.
What does it not detect?
A bare name in free text with no cue passes through. Health, religion or income stated in prose is not detected. In the browser, PDF and image uploads are not inspected. In Claude Code, PDF and image masking needs macOS or the poppler, tesseract and ImageMagick tools; without them the file is withheld.
How is mask2ai different from other privacy extensions?
It restores the real values on your screen, in file edits and in commands, so your work keeps flowing. It works inside Claude Code as well as the browser. And it ships tests that capture every request and fail if a real value gets through.
Is mask2ai the same as Mask AI?
No. mask2ai, as in "mask to AI", is an open source privacy tool by Serkan Korkut at github.com/serkankorkut/mask2ai. It is not related to companies or products called Mask AI.
Works where you work.
Claude Code CLI as a plugin. claude.ai and ChatGPT in Chrome as an extension. Each one is verified against the real thing on every change.