alcatraz

Alcatraz is a Go library that detects personally identifiable information, or PII, inside text: things like email addresses, credit card numbers, national ID numbers, and similar sensitive data. It covers 45 different types of these identifiers across 12 countries. Unlike many PII detection tools, which run as a separate service you call over a network, Alcatraz runs directly inside your own program as a simple function call, with no server to deploy and no machine learning models to download for its core functionality.

A key strength is that many of its detectors do not just look for text that resembles a certain pattern, they actually verify it. For example, a credit card number is checked against the Luhn algorithm, a standard math formula used to catch invalid card numbers, so a string of digits that merely looks like a credit card but fails that check gets dropped rather than flagged as a false positive. Similar real validation exists for bank account numbers, national ID schemes in several countries, and more.

The core of the library has no dependencies outside Go's own standard library, and its pattern matching is built to run in linear time, avoiding the kind of slow, backtracking-heavy regular expressions that can be exploited to freeze a program. An optional add-on module can detect harder cases like names, locations, and free-text dates using a small machine learning model that still runs locally, without calling out to the internet.

Beyond the library, Alcatraz ships as a command-line tool that can scan log files, piped text, or the changed lines in a git diff, always masking any sensitive values it finds in its output. It also includes a companion package for turning detected spans into cleaned text, offering choices like masking characters, keeping the last few digits visible, or replacing a value entirely with a placeholder like an EMAIL_ADDRESS tag.

The project is explicitly marked experimental and under active development, and its authors warn that the public interface may still change, including breaking changes, before it reaches a stable 1.0 release.