Intelligence & OSINT · free, no signup
Tabular PII Scanner
Paste a CSV, TSV or query result and see which COLUMNS carry personal data — before the file is attached to a ticket or sent to a vendor. It never echoes a value: every finding names the column and a count, because a scanner that quotes the card number it found has copied the exposure into a second document, and that one travels further because it looks like a report. Detection is verified rather than guessed — card candidates are checked with Luhn and IBAN candidates with mod-97, so a sixteen-digit order reference is not reported as a payment card. The finding easiest to miss by eye: a table with no name and no email can still be personal data, because date of birth, sex and postal code together re-identify most of a population while each looks harmless alone.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste a CSV, TSV or query result and see which columns carry personal data — before the file is attached to a ticket or sent to a vendor. Card and account numbers are checked arithmetically (Luhn, mod-97), so a sixteen-digit order reference is not reported as a payment card.
No value you paste is ever echoed back. Findings name the column and a count, never the cell — quoting a match would copy the exposure into a second document that travels further, because it looks like a report. Scanning happens on the server and nothing is stored; even so, prefer a redacted sample.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The OSINT Exposure Assessment engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore OSINT Exposure Assessment