octocode-data-masker
Advanced tools
A TypeScript library for masking sensitive data in strings, including PII, tokens, API keys, and more
A high-performance TypeScript library for detecting and masking sensitive data in strings. Protect PII, API keys, tokens, credentials, and other confidential information with intelligent masking algorithms and configurable accuracy levels.
npm install sensitive-data-masker
yarn add sensitive-data-masker
import { mask, hasSensitiveContent, getPatternMatches } from 'sensitive-data-masker';
// Basic usage - intelligent partial masking
const text = 'My email is john@example.com and my SSN is 123-45-6789';
const result = mask(text);
console.log(result.output);
// "My email is **hn@example.c** and my SSN is **3-45-67**"
console.log(result.found);
// { email: 1, ssn: 1 }
// Check if content contains sensitive data
const isSensitive = hasSensitiveContent(text);
console.log(isSensitive); // true
// Get detailed pattern matches with positions
const matches = getPatternMatches(text);
console.log(matches);
// [
// {
// pattern: 'email',
// matches: [{ match: 'john@example.com', startIndex: 12, endIndex: 27 }]
// },
// {
// pattern: 'ssn',
// matches: [{ match: '123-45-6789', startIndex: 44, endIndex: 54 }]
// }
// ]
mask(input: string, options?: MaskingOptions): MaskResultMasks sensitive content in a string using intelligent partial masking.
interface MaskingOptions {
maskChar?: string; // Character used for masking (default: '*')
preserveLength?: boolean; // Preserve original length (default: false)
excludePatterns?: string[]; // Patterns to exclude from masking
onlyPatterns?: string[]; // Only mask these patterns
matchAccuracy?: 'high' | 'medium' | 'low'; // Detection sensitivity
}
interface MaskResult {
output: string; // Masked string
found: { [name: string]: number }; // Count of each pattern found
matches: string[]; // Original matched values
masked: string[]; // Masked versions of matches
}
hasSensitiveContent(input: string, options?): booleanQuickly check if a string contains sensitive data without performing masking.
import { hasSensitiveContent } from 'sensitive-data-masker';
hasSensitiveContent('user@example.com'); // true
hasSensitiveContent('hello world'); // false
// With options
hasSensitiveContent('sk-1234567890abcdef', {
matchAccuracy: 'high',
excludePatterns: ['genericId']
}); // true
getPatternMatches(input: string, options?): PatternMatch[]Get detailed information about all pattern matches including their positions.
import { getPatternMatches } from 'sensitive-data-masker';
const matches = getPatternMatches('Contact: admin@test.com and key: sk-123abc');
console.log(matches);
// [
// {
// pattern: 'email',
// matches: [{ match: 'admin@test.com', startIndex: 9, endIndex: 22 }]
// },
// {
// pattern: 'openaiApiKey',
// matches: [{ match: 'sk-123abc', startIndex: 33, endIndex: 41 }]
// }
// ]
import { mask } from 'sensitive-data-masker';
// Custom masking character
const result = mask('API key: sk-1234567890abcdef', { maskChar: '#' });
console.log(result.output);
// "API key: ##-1234567890ab##"
// Preserve original length
const result2 = mask('secret123', { preserveLength: true });
console.log(result2.output);
// "*********" (full length masked)
// Use high accuracy mode (fewer false positives)
const result3 = mask('sk-1234567890abcdef', { matchAccuracy: 'high' });
console.log(result3.output);
// "##-1234567890ab##"
// Only mask specific patterns
const result = mask('Email: user@test.com, API: sk-123', {
onlyPatterns: ['email', 'openaiApiKey']
});
// Exclude certain patterns
const result2 = mask('Email: user@test.com, UUID: 123e4567-e89b-12d3-a456-426614174000', {
excludePatterns: ['uuid', 'genericId']
});
// Combine with accuracy control
const result3 = mask(sensitiveText, {
matchAccuracy: 'high',
excludePatterns: ['uuid']
});
The library detects sensitive data across 25 categories with 200+ patterns:
X-API-Key, Authorization)Control detection sensitivity to balance between security and false positives:
AKIA prefix, specific API key formats// Use high accuracy for production
const prodResult = mask(text, { matchAccuracy: 'high' });
// Use medium accuracy for development
const devResult = mask(text, { matchAccuracy: 'medium' });
// Use low accuracy for comprehensive scanning
const scanResult = mask(text, { matchAccuracy: 'low' });
Full TypeScript support with complete type definitions:
import { mask, hasSensitiveContent, getPatternMatches } from 'sensitive-data-masker';
import type { MaskResult, MaskingOptions } from 'sensitive-data-masker';
// Type-safe masking options
const options: MaskingOptions = {
maskChar: '#',
matchAccuracy: 'high',
excludePatterns: ['uuid']
};
const result: MaskResult = mask(text, options);
import { mask } from 'sensitive-data-masker';
const logEntry = `
[2024-01-15 10:30:45] INFO User john@company.com logged in
[2024-01-15 10:31:12] DEBUG API call with key sk-1234567890abcdef
[2024-01-15 10:31:15] ERROR Payment failed for card 4111-1111-1111-1111
[2024-01-15 10:31:20] WARN SSN in request: 123-45-6789
`;
const sanitized = mask(logEntry);
console.log(sanitized.output);
// [2024-01-15 10:30:45] INFO User **hn@company.c** logged in
// [2024-01-15 10:31:12] DEBUG API call with key **-1234567890ab**
// [2024-01-15 10:31:15] ERROR Payment failed for card **11-1111-1111-11**
// [2024-01-15 10:31:20] WARN SSN in request: **3-45-67**
console.log(sanitized.found);
// { email: 1, openaiApiKey: 1, creditCard: 1, ssn: 1 }
const config = `
DATABASE_URL=postgresql://user:password123@localhost:5432/db
OPENAI_API_KEY=sk-1234567890abcdef1234567890abcdef
STRIPE_SECRET_KEY=sk_live_abcdef123456
ADMIN_EMAIL=admin@company.com
JWT_SECRET=super-secret-key-123
`;
const result = mask(config);
console.log(result.output);
// DATABASE_URL=postgresql://user:**ssword1** @localhost:5432/db
// OPENAI_API_KEY=**-1234567890abcdef1234567890ab**
// STRIPE_SECRET_KEY=**_live_abcdef12**
// ADMIN_EMAIL=**min@company.c**
// JWT_SECRET=**per-secret-key-1**
import { mask } from 'sensitive-data-masker';
// Production: Mask everything with high accuracy
const prodResult = mask(sensitiveData, { matchAccuracy: 'high' });
// Development: Allow test emails but mask real API keys
const devResult = mask(sensitiveData, {
matchAccuracy: 'medium',
excludePatterns: ['email']
});
// Testing: Only mask financial data
const testResult = mask(sensitiveData, {
onlyPatterns: ['creditCard', 'bankAccount', 'ssn'],
matchAccuracy: 'high'
});
import { hasSensitiveContent, mask } from 'sensitive-data-masker';
// Check if data needs processing
function processBatch(records: string[]) {
const results = records.map(record => {
if (hasSensitiveContent(record)) {
const masked = mask(record, { matchAccuracy: 'high' });
return {
data: masked.output,
hadSensitiveData: true,
patternsFound: Object.keys(masked.found)
};
}
return { data: record, hadSensitiveData: false };
});
return results;
}
onlyPatterns when you know which types to look for// Optimize for specific use cases
const emailsOnly = mask(text, { onlyPatterns: ['email'] }); // Faster
const highAccuracy = mask(text, { matchAccuracy: 'high' }); // Faster, fewer false positives
const comprehensive = mask(text, { matchAccuracy: 'low' }); // Slower, more thorough
matches array contains original sensitive valuesgit clone https://github.com/bgauryy/sensitive-data-mask.git
cd sensitive-data-mask
yarn install
yarn build # Build the library
yarn dev # Build in watch mode
yarn lint # Run ESLint
yarn test # Run tests
yarn typecheck # Run TypeScript compiler checks
Contributions are welcome! Please feel free to submit a Pull Request.
src/regexes/{
name: 'myPattern',
regex: /your-regex-here/gi,
description: 'Description of what this detects',
matchAccuracy: 'medium' // optional: 'high', 'medium', or 'low'
}
MIT © guybary
If you discover a security vulnerability, please email guybary@wix.com instead of using the issue tracker.
Made with ❤️ for developers who care about data security
FAQs
A TypeScript library for masking sensitive data in strings, including PII, tokens, API keys, and more
The npm package octocode-data-masker receives a total of 17 weekly downloads. As such, octocode-data-masker popularity was classified as not popular.
We found that octocode-data-masker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.
Security News
/Research
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.
Security News
Knip hits 500 releases with v5.62.0, refining TypeScript config detection and updating plugins as monthly npm downloads approach 12M.