llm-redact

Reversible PII redaction (pseudonymization) for LLM pipelines. Zero dependencies. Offline. Edge/browser-ready.

Live demo — 100% in-browser; data never leaves your device (source).

import { redact } from "llm-redact";

const r = redact("Hi, I'm Jan Kowalski, [email protected], PESEL 90010112349");
r.text; // redacted placeholders
const reply = await callLLM(r.text);
r.restore(reply); // placeholders → originals

Install

npm install llm-redact

Features

• Reversible pseudonymization sandwich: redact → LLM → restore
• Core rules: email, phone, IBAN, card (Luhn), IP, API keys, URL credentials, greeting names
• EU locales: llm-redact/locales/pl (PESEL, NIP, REGON), llm-redact/locales/de
• Streaming restore via llm-redact/stream — zero extra latency except incomplete placeholder prefixes
• Modes: placeholder (default), mask, fake
• Placeholder injection guard
• Zero runtime dependencies in core

Adapters (optional)

Network and AI SDK integrations live in a separate package so core stays offline and dependency-free:

npm install llm-redact-adapters

import { redactedFetch } from "llm-redact-adapters/fetch";
import { redactMiddleware } from "llm-redact-adapters/ai-sdk";

await redactedFetch(fetch, url, { body: userInput });

See llm-redact-adapters on npm and SECURITY.md.

Configuration

import { redact } from "llm-redact";
import { pl } from "llm-redact/locales/pl";

const r = redact(input, {
  locales: [pl],
  rules: { NAME: false },
  custom: [{ type: "ACC_ID", pattern: /\bACC-\d{6}\b/g }],
  mode: "placeholder",
  seed: sessionId,
});

Streaming

import { restoreStream } from "llm-redact/stream";

const stream = response.body
  .pipeThrough(new TextDecoderStream())
  .pipeThrough(restoreStream(r));

Why not X?

| Tool | Reversible | Streaming restore | JS-native | EU locales | |------|------------|-------------------|-------------|------------| | llm-redact | yes | yes | yes | pl, de | | redact-pii | no | no | yes | no | | @redactpii/node | no | no | yes | no | | Microsoft Presidio | yes | no | Python | partial | | AI gateways | yes | partial | infra | yes ($$$) |

LIMITATIONS

• Regex/heuristics only — will not catch free-form names in prose (use explicit NAME greetings or future opt-in NER module)
• Not 100% recall — false negatives are possible
• Not a RODO/compliance solution — first-pass developer privacy filter
• NAME detection is greeting-heuristic only (Dear X, I'm X, pozdrawiam X)

License

MIT