PII redaction extensions for AI chat: the field, honestly surveyed
If you go looking for a browser extension that masks personal data before it reaches ChatGPT or Claude, you will find a small and young field. We should say immediately: Velum Lite is ours. This survey exists because the comparison pages that rank for these searches rarely disclose anything, and because every claim below is checkable against the tools' own listings and sites, which is exactly what we suggest you do. All facts were checked on 2026-08-09.
What to compare on
Four properties separate these tools more than any feature list.
Where the processing runs. Every tool below claims local processing except where noted. The claim matters because a redaction service that receives your raw text has seen your raw text. The test is whether masking works with the network disconnected.
Whether masking is reversible. One-way tools delete or block sensitive text before it is sent; the AI's reply then talks about placeholders or gaps. Two-way tools restore the original details in the reply, locally, which keeps the answer usable.
Whether the claim is auditable. "100% local" is easy to write. It is verifiable when the source is readable or the network behaviour is observable, and a matter of trust otherwise.
What it costs and where it works. Free tiers, supported browsers, supported chat sites.
The field
Caviard (caviard.ai) masks in the page and restores in replies with a local reveal shortcut. Two-way, states that everything runs locally in the browser. Chrome only, and it supports ChatGPT and DeepSeek specifically. Source is not public, so the local claim rests on their word or your own traffic inspection.
PrivacyScrubber (privacyscrubber.com) uses deterministic tokens with one-click local restore, and extends beyond chat with OCR on images, PDFs, and an MCP server for IDE assistants. Two-way. States that data never leaves your machine; source is not public. Free tier with character limits, paid from $15 a month.
Private Prompt (safeyourprompt.com) replaces data with placeholders before sending and restores originals in the reply, on ChatGPT, Claude, Gemini, Grok and Perplexity, in Chrome and Firefox. Two-way, states 100% local processing; source is not public. Free tier of five anonymisations a day, paid from $9.99 a month. Notably strong on Polish identifiers.
Paste Redactor (redactor.negativestarinnovators.com) is one-way: it inserts safe placeholders at paste time using an on-device model, across Chromium browsers, Firefox, and a Windows app. No restore. The detection model is openly published, the extension code is not. Their listing includes an honesty note that the detector will sometimes miss real PII and flag harmless text; more vendors should write that sentence. Free for 100 redactions a month, then $9 a year.
Redact by Clearform Labs (github.com/Clearform-Labs/Redact) takes a guard-rail approach: it warns or blocks before sensitive text is pasted into eight major chat sites, using a small on-device model, and makes no network calls. One-way by design, no restore. It is the one extension in this list whose source you can actually read, under a source-available licence. Free.
Velum Lite (ours) is two-way with both masking styles: opaque tokens like ⟦PERSON_1⟧, or format-valid stand-ins, restored locally in the reply either way. It works as a popup, so it is not limited to particular chat sites, and it runs in Chrome and Firefox with no network access at all, which you can verify by using it offline. Detection uses a regex floor plus an optional on-device NER model with country packs for seven countries, and the measured accuracy, including what slips through, is published on the benchmarks page. The core masking is free with no account; a licence adds the desktop app.
Two adjacent things are worth knowing about even though they are not extensions: Microsoft Presidio, an open-source Python framework for teams building their own de-identification (we compared it to Velum here), and OpenAI's privacy-filter, an openly licensed detection model that developers can run locally, detection only, no restore.
Reading the field
Three patterns stand out. First, reversibility splits the field cleanly: Caviard, PrivacyScrubber, Private Prompt and Velum restore; Paste Redactor and Redact are deliberate one-way guards. Which you want depends on whether you need the AI's answer to come back usable or need pasting policed. Second, nearly everyone says "100% local", but only a minority can be audited: Redact publishes its extension source, Paste Redactor its model, Velum its measured benchmarks and offline-testable behaviour. For the rest, the claim may well be true, and you cannot currently check it from the outside. Third, everything here is young and small, ourselves included; treat every tool, again ourselves included, as something to verify against your own material before you rely on it.
The verification costs nothing: install one, cut your network, and see what still works. Then paste a real document from your work, the messy kind, and look at what was caught and what was not. Ten minutes of that is worth more than this or any other survey.