Detect and redact PII from documents locally
PII GUI is a local-first Tauri desktop app that detects and redacts personal information in PDFs and text entirely on your device.
Why it matters
Users hire PII GUI to find and permanently remove personal information-names, emails, phone numbers, addresses, account numbers, and secrets-from PDFs, markdown, and text files entirely on their own device, with no cloud upload or network dependency, so they can safely share documents while maintaining full control over sensitive data.
Outcomes
What it gets done
Parse PDFs, markdown, and text files to extract content with character-level position tracking for accurate highlighting
Run regex or ONNX model inference locally to detect eight categories of PII across multiple languages
Review and toggle individual PII matches in an interactive workbench before finalizing redactions
Export redacted documents with burned-in PDF rectangles or reversible text placeholders that prevent data recovery
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/sophia486-pii-gui | bash Overview
Pii Gui
PII GUI is a local-first Tauri desktop app that detects and redacts personal information in PDFs, Markdown, and text using built-in regex or local ONNX models, with reviewable matches and genuinely unrecoverable burned-in PDF redaction - no document content ever leaves the device. Use it whenever PII detection and redaction must happen entirely on-device with no cloud upload; it's a desktop app needing platform build tools to build from source, and coding-agent integration is still on the roadmap, not yet shipped.
What it does
PII GUI is a Tauri 2 desktop app (React/TypeScript frontend, Rust backend) that finds and redacts personal information in documents entirely on-device. Load a PDF, Markdown, or plain-text file, detect PII with built-in regex rules or local quantized ONNX models, review every match in a workbench (toggling individual matches on or off before export), and export a safely redacted copy - no document content ever leaves the machine, and the only network access at all is an optional one-time model download from Hugging Face.
Detection supports three backends: built-in regex (instant baseline detection of emails, phones, URLs, dates, account numbers, and secrets), the OpenAI Privacy Filter ONNX model (long English documents, broad privacy-taxonomy detection), and BardsAI's EU PII model (European-language text where names, addresses, and ID-like entities matter). Matches are labeled against a fixed taxonomy: account_number, private_address, private_email, private_person, private_phone, private_url, private_date, and secret. Custom regex or exact-match rules can be layered on top of any backend. PDF redaction is genuine, not cosmetic - approved redactions are burned into exported pages with pdf-lib as opaque rectangles, so the underlying text is not recoverable from the output file; a companion PII-to-text workflow can also restore reviewed placeholders back into readable text for a reversible local review pass. Task history, tabs, custom rules, and filter results persist across restarts via a local SQLite database, and long documents are handled by splitting input into token-bounded, page-aware chunks processed through a task queue. The UI is localized in English, Korean, and Japanese.
Benchmarked locally on an Apple M1 Max (ONNX Runtime CPUExecutionProvider, 1024-token chunks), the OpenAI Privacy Filter model's int8-dynamic and q4 quantizations were the fastest variants (about 1,800 tok/s and 1,776 tok/s respectively on 1k-token input), while fp16 and q4f16 ran slower than plain fp32 on this CPU path.
When to use - and when NOT to
Use PII GUI when you need to detect and redact personal information in documents (resumes, forms, PDFs, plain text) without sending the document content to any cloud service - it's built for cases where local-only processing is a hard requirement, not just a preference, since detection runs entirely on-device and network access is limited to an optional, removable model download. It's a fit for reviewing matches manually before committing to a redaction, and for cases requiring provably unrecoverable PDF redaction rather than just visually-hidden text.
It's a desktop application requiring Node.js 24+, pnpm, Rust/Cargo, and the Tauri v2 platform prerequisites to build from source (though prebuilt installers are available for macOS, Windows, and Linux from Releases). Per its own roadmap, broader import/export QA for large PDFs and multilingual documents, an accessibility/keyboard-only review pass, and integration with coding agents (Codex, Claude Code, Cursor) are still in progress, not yet shipped.
Inputs and outputs
Input is a PDF, Markdown, or plain-text file loaded into the app; PDFs are parsed with pdf.js preserving per-character positions so detections highlight directly on the rendered page. Install a prebuilt release from the Releases page, or build from source:
cd tauri
pnpm install
pnpm tauri dev
Processing flow: text extraction, token-bounded page-aware chunking, a task queue dispatching to the Rust backend's redact_text command, regex or ONNX inference (via ort and tokenizers), and matches returned for review in the UI. Output is either an exported redacted PDF (with redactions burned into the rendered pages so text is unrecoverable) or redacted plain text, plus persisted task history, custom rules, and filter results in a local SQLite database and on-disk result files - all writes confined to the Tauri app data directory.
Integrations
PII GUI integrates pdf.js and pdf-lib for PDF parsing and redacted export, ONNX Runtime and Hugging Face's tokenizers for local model inference, and two optional Hugging Face-hosted detection models (OpenAI's Privacy Filter and BardsAI's EU PII model) fetched once and cached locally, removable anytime from Settings. The frontend uses React 19, shadcn/Radix UI primitives, and the app is packaged and distributed cross-platform via Tauri v2.
Who it's for
Individuals and teams who need to redact personal information from documents under a strict no-cloud, no-data-leaves-the-machine requirement - handling resumes, forms, or other PII-bearing PDFs and text files - and who want to review and control every detected match before committing to an export, backed by provably unrecoverable PDF redaction rather than a visual-only overlay. It is licensed under AGPL-3.0.
Source README
PII GUI
Find and redact personal information in documents - entirely on your device.
Load a PDF, markdown, or text file, detect PII with built-in rules or local ONNX models, review every match, and export a safely redacted copy. No document content ever leaves your machine.
Example · Features · Detection Backends · Benchmarks · Setup · Development · Roadmap
PII GUI is a Tauri 2 desktop app (React 19 + TypeScript frontend, Rust backend) for local-first PII detection and redaction. Detection runs on-device with regex rules or quantized ONNX models; the only network access is the optional one-time model download.
Example
PII GUI supports two local workflows.
| Text <-> PII | Redact PDF |
|---|---|
| Text -> PII: detect names, emails, phone numbers, URLs, dates, IDs, and secrets before exporting a redacted copy. PII -> Text: restore reviewed placeholders back into readable text when you need a reversible local review workflow. | Burn approved redactions into exported PDFs so hidden text is not recoverable from the output file. |
Features
- Local inference only - PII detection runs entirely on-device. The only network access is the optional one-time model download from Hugging Face.
- PDF, Markdown, and plain-text input - PDFs are parsed with pdf.js, preserving per-character positions so detections are highlighted directly on the rendered page.
- Custom rules - add your own regex or exact-match filters on top of any backend.
- Review before redacting - toggle individual matches on or off in the workbench before export.
- True PDF redaction - exported PDFs burn opaque rectangles into the rendered pages with pdf-lib, so redacted text is not recoverable from the output file.
- Task history and persistence - tabs, custom rules, and filter results survive restarts via a local SQLite database and on-disk result files.
- Long-document support - input is split into token-bounded, page-aware chunks and processed through a task queue.
- Localized UI - English, Korean, and Japanese.
Detection Backends
| Backend | Best for |
|---|---|
| Regex (built-in) | Instant baseline detection of emails, phones, URLs, dates, account numbers, and secrets |
| OpenAI Privacy Filter | Long English documents and broad privacy-taxonomy detection |
| BardsAI EU PII | European-language text where names, addresses, and ID-like entities matter |
Detection taxonomy
Matches are labeled with a fixed privacy taxonomy:
account_number · private_address · private_email · private_person · private_phone · private_url · private_date · secret
Benchmarks
OpenAI Privacy Filter ONNX inference was measured locally on an Apple M1 Max using ONNX Runtime CPUExecutionProvider. The benchmark uses 1024-token chunks, strips speaker-name lines, and reports the median of 3 measured repeats after 1 warmup run.
| Model | Quantization | 1k latency | 1k throughput | 8k latency | 8k throughput |
|---|---|---|---|---|---|
openai/privacy-filter |
fp32 | 620.52 ms | 1,664 tok/s | 4,893.86 ms | 1,689 tok/s |
openai/privacy-filter |
fp16 | 654.56 ms | 1,578 tok/s | 5,430.17 ms | 1,521 tok/s |
openai/privacy-filter |
q4 | 582.13 ms | 1,776 tok/s | 4,635.39 ms | 1,784 tok/s |
openai/privacy-filter |
q4f16 | 648.10 ms | 1,594 tok/s | 5,261.56 ms | 1,570 tok/s |
openai/privacy-filter |
int8 dynamic | 573.94 ms | 1,801 tok/s | 4,594.95 ms | 1,800 tok/s |
On this Apple M1 Max CPU path, the int8 dynamic and q4 variants were the fastest. fp16 and q4f16 were slower than fp32 with CPUExecutionProvider.
Requirements
- Node.js 24+
- pnpm
- Rust and Cargo
- Tauri v2 platform prerequisites for your OS
Setup
Download the latest installer for macOS, Windows, or Linux from the Releases page.
On first launch, the onboarding flow lets you pick a default backend. Regex works immediately; the ONNX models are optional downloads (fetched from Hugging Face into the app data directory, and removable at any time from Settings).
Install from source:
cd tauri
pnpm install
Local release signing values are optional for development. If you need updater signing locally, copy the environment template and fill in your own key:
cp .env.example .env
How it works
Document (PDF / md / txt)
→ text extraction (pdf.js, per-character boxes for PDFs)
→ token-bounded, page-aware chunking
→ task queue → Rust `redact_text` command
→ regex / ONNX inference (ort + tokenizers)
→ matches + redacted text
→ review & toggle matches in the UI
→ export (burned-in PDF redaction or redacted text)
The frontend (React) handles document parsing, chunking, review, and export. The Rust backend (src-tauri/) owns the detection engines, model lifecycle (download / verify / delete), and file I/O - all writes are confined to the Tauri app data directory.
Development
Run from source
cd tauri
pnpm install
pnpm tauri dev
Build
cd tauri
pnpm tauri build
Tests
cd tauri
pnpm test:unit # frontend unit tests (vitest)
pnpm build # typecheck + frontend build
cd src-tauri
cargo test # Rust backend tests
Roadmap
- Local regex detection and review workflow
- Optional ONNX backend wiring for OpenAI Privacy Filter and BardsAI EU PII
- Burned-in PDF redaction export
- Local tab, custom-rule, and result persistence
- Broader import/export QA for large PDFs and multilingual documents
- Accessibility and keyboard-only review pass
- Integration with coding agents (Codex, Claude Code, Cursor)
Project structure
tauri/ # the desktop app
src/ # React frontend
App.tsx # orchestrator: tabs, routing, workbench
components/ # PDF preview, shadcn/Radix UI primitives
lib/
pdf-document.ts # pdf.js text + char-box extraction
pii-text-chunks.ts # token-bounded chunking
pii-task-queue.ts # detection task queue
redaction-policy.ts # match merge/select/restore logic
pdf-redacted-export.ts# burned-in PDF redaction export
app-persistence.ts # SQLite + result-file persistence
i18n.ts # en / ko / ja UI copy
src-tauri/ # Rust backend
src/lib.rs # Tauri commands: redact_text, model lifecycle, file I/O
src/redact_engine.rs # regex / ONNX / BardsAI detection backends
docs/assets/ # README thumbnail and screenshot assets
.github/workflows/release.yml # cross-platform release builds
Verification
Run the smallest check that proves the change, then widen as needed:
cd tauri && pnpm test:unit
cd tauri && pnpm build
cd tauri/src-tauri && cargo check
git diff --check
For packaging, run pnpm tauri build on the target platform before making release claims.
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.