ConvertDuck

Redact & Restore

Mask emails, phone numbers, card numbers, and API keys before pasting into an AI chat — then restore the real values from the reply. Nothing leaves your browser.

Items processed: 0

Original values are stored only in this browser tab's session storage and are never sent anywhere. They're cleared when you close this tab.

Stored in this session: 0

What actually happened, January 2026

900,000 people installed these thinking they were harmless

Two Chrome extensions — one with Google's own “Featured” badge — were caught detecting when you were on chatgpt.com or deepseek.com and quietly shipping your prompts, responses, and session ID to an outside server every 30 minutes. People installed them for a sidebar and multi-model switching. They got a leak instead.

The Hacker News →

Here's the same moment — pasting something with real personal info into an AI chat — with Redact & Restore instead:

🔒 stays on your device What you type “email me at [email protected]”
↗ leaves your browser What leaves your browser “email me at [EMAIL_1]”
↗ leaves your browser What the AI sends back “sent to [EMAIL_1]”
🔒 stays on your device What you see “sent to [email protected]”

↑ the only thing that ever crosses this line: What leaves your browser / What the AI sends back

The mapping between [EMAIL_1] and your real address lives in this browser tab's session storage — nowhere else. Close the tab and it's gone. No server, ours or theirs, ever sees both sides.

Send AI Your Question, Not Your Personal Data

Pasting a real email, phone number, or API key into an AI chat means it's now stored on that provider's servers. This tool finds that kind of personal info in your text, replaces it with a placeholder like [EMAIL_1], and remembers the real value only in this browser tab's session storage. Paste the masked text into your AI chat, then paste the reply back here to swap the placeholders for the real values again.

How to Redact and Restore

1. Redact Before Sending

Paste your text, switch to Redact mode, and copy the masked output to paste into your AI chat.

2. Get Your AI Response

The AI sees only placeholders like [EMAIL_1], never the real values.

3. Restore After Receiving

Switch to Restore mode, paste the AI's reply, and get back the real values in their place.

Where the Mapping Lives

StorageSession storage in this browser tab only — never sent to any server, cleared when you close the tab.
DetectionPattern matching (regular expressions); always double-check before sending sensitive text anywhere.

Redact & Restore vs. Simple Masking Tools

FeatureRedact & RestoreTypical Masking Tool
DirectionMasks and restoresMasks only — no way back
Where values liveThis browser tab's session onlyOften a server or extension storage
CostFreeOften a paid extension

Frequently Asked Questions

Q.Where is my real data stored?▼
Only in this browser tab's session storage. It's never sent to any server, and it's cleared automatically when you close the tab.
Q.What happens if I close the tab before restoring?▼
The mapping is lost, since it only lives in that tab's session storage — you'd need to redact again to build a fresh mapping.
Q.Can it miss something?▼
Yes — detection is pattern-based, so unusual formats may be missed or an unrelated number might get flagged. Always review the redacted text before sending it anywhere.