hush

hush is a tiny zero-dependency PII redactor for Node.js. It detects and replaces personally-identifiable information in free-form text — emails, phone numbers, credit cards, IPv4/IPv6 addresses, MAC addresses, US Social Security numbers, AWS access keys, Bearer tokens, and high-entropy credentials — with safe placeholder tokens.

Use it for log scrubbing, customer support transcripts, debugging output that leaves your laptop, or anywhere you need to share a string but hide the humans inside it.

Install

hush is not yet published to npm. Install directly from GitHub:

npm install github:prasad-a-abhishek/hush

Quick start

const hush = require('hush');

hush.hush('Contact [email protected] or 555-123-4567');
// → 'Contact [EMAIL] or [PHONE]'

hush.hush('Card 4111 1111 1111 1111, key AKIAIOSFODNN7EXAMPLE');
// → 'Card [CARD], key [AWS_KEY]'

hush.count('[email protected] and [email protected]');
// → 2

hush.has('just plain text');
// → false

What it detects

| Type | Default token | Example pattern | |----------|---------------|------------------------------------------| | Email | [EMAIL] | [email protected] | | Phone | [PHONE] | +1 (555) 123-4567, 555.123.4567 | | Credit card | [CARD] | 4111 1111 1111 1111 (Luhn-validated) | | IPv4 | [IPV4] | 192.168.1.1, 8.8.8.8 | | IPv6 | [IPV6] | 2001:db8::1, ::1 | | MAC | [MAC] | 00:1B:44:11:3A:B7 | | SSN | [SSN] | 123-45-6789 (excludes 000/666/9xx area)| | AWS key | [AWS_KEY] | AKIAIOSFODNN7EXAMPLE | | Bearer | [BEARER] | Bearer abc123def456... | | Secret | [SECRET] | api_key=..., password: ... (label kept) |

API

hush(input, options?) → string

Returns input with PII replaced. If no PII is detected, the original input is returned (your reference to it stays valid). When PII is redacted, a new string is returned.

Options:

• replacement: string (used for all types) or object { email: 'E', phone: 'P', ... } (per-type; falls back to default for unlisted types)
• disable: array of type names to skip (e.g. ['email', 'ipv4'])

hush.count(input, options?) → number

Returns the count of PII items found. Same options shape.

hush.has(input, options?) → boolean

Returns true if any PII was detected. has() short-circuits on the first match found across all enabled detectors, so for inputs without PII it is significantly faster than count().

hush.HushStream

A Transform stream. Write text in, get redacted text out.

const { HushStream } = require('hush');
process.stdin.pipe(new HushStream()).pipe(process.stdout);

CLI

echo 'Contact [email protected]' | npx hush --stdin
# Contact [EMAIL]

npx hush --count --stdin < app.log
# 47

npx hush --json --stdin < access.log | jq '.email'
# 23

Flags:

• --stdin — read from standard input
• --disable <list> — comma-separated types to skip (e.g. email,phone,ipv4)
• --replacement <s> — single replacement for all types
• --count — print just the count, no redaction
• --json — print per-type counts as JSON

Design choices

• Conservative over aggressive. When in doubt, hush keeps the original text. False negatives (missing real PII) are better than false positives (breaking legitimate content).
• Credit cards require a valid Luhn checksum. A random 16-digit number is not redacted as a card.
• Phone numbers require ≥10 digits after stripping separators. Short digit runs like "PIN 12345" are left alone. Phone-shaped strings that look like a malformed IPv4 address (four numeric groups separated by dots, e.g. 999.999.999.999) are NOT classified as phones.
• SSN exclusion for 000/666/9xx area numbers (real SSNs never have these).
• Secret values keep their keyword label (api_key=... becomes api_key=[SECRET], not just [SECRET]). You can still see which credential was leaked.

Limitations

• Phone numbers concatenated with a word (no separator) are not detected: 555-123-4567alice is not a phone.
• The CC detector uses Luhn, which catches the most common 16-digit cards. Some 13/15/19-digit cards may be missed if Luhn fails.
• This is regex-based PII detection, not a true parser. For high-stakes compliance, post-process the output with a real PII classifier.

License

MIT