piimask

README

piimask

Format-preserving PII redaction and token masking for structured logs and user interfaces in Go.

Features

• Standard library only (net/netip, strings, unicode/utf8).
• Decodes runes directly to avoid breaking multi-byte UTF-8 sequences in international addresses (björn@example.com becomes b•••n@example.com).
• Preserves leading zeros in IPv6 addresses (fe80:••••:••••:0001).
• Runs in 60 ns per call with 1 allocation using net/netip and strings.Builder.
• Masks emails, IPv4/IPv6 addresses, tokens, API keys, device IDs, payment cards, and phone numbers.

Installation

go get github.com/fumbledlol/piimask

Usage

package main

import (
	"fmt"

	"github.com/fumbledlol/piimask"
)

func main() {
	// Email addresses
	fmt.Println(piimask.MaskEmail("alexander@example.com"))
	// al•••••er@example.com

	// IPv4 and IPv6
	fmt.Println(piimask.MaskIP("192.168.1.100"))
	// 192.••.••.100
	fmt.Println(piimask.MaskIP("2001:0db8:85a3:0000:0000:8a2e:0370:7334"))
	// 2001:••••:••••:7334

	// Tokens and device IDs
	fmt.Println(piimask.MaskToken("dev_tok_9f823a789bc123"))
	// dev_••••••••••••c123

	// Payment cards
	fmt.Println(piimask.MaskCreditCard("4111 2222 3333 4444"))
	// •••• •••• •••• 4444

	// Phone numbers
	fmt.Println(piimask.MaskPhone("+1 (555) 123-4567"))
	// +1••••••4567
}

Structured logging with slog

slog.Info("user login",
    slog.String("email", piimask.MaskEmail(user.Email)),
    slog.String("ip", piimask.MaskIP(clientIP)),
)

Benchmarks

BenchmarkMaskEmail-12     21070707        61.46 ns/op        48 B/op       1 allocs/op
BenchmarkMaskIP-12        18037436        61.49 ns/op        24 B/op       1 allocs/op
BenchmarkMaskToken-12      4674932       245.10 ns/op       144 B/op       2 allocs/op

License

MIT

Documentation

Index

• func MaskCreditCard(cardNumber string) string
• func MaskDeviceID(token string) string
• func MaskEmail(email string) string
• func MaskIP(ipStr string) string
• func MaskPhone(phone string) string
• func MaskToken(token string) string

Functions

func MaskCreditCard

func MaskCreditCard(cardNumber string) string

MaskCreditCard masks card numbers, preserving only the last 4 digits.

func MaskDeviceID

func MaskDeviceID(token string) string

MaskDeviceID is an alias for MaskToken for device identifier strings.

func MaskEmail

func MaskEmail(email string) string

MaskEmail masks the local part of an email address while preserving domain and casing. Safely handles UTF-8 runes without multibyte corruption.

func MaskIP

func MaskIP(ipStr string) string

MaskIP masks the middle segments of IPv4 and IPv6 addresses.

func MaskPhone

func MaskPhone(phone string) string

MaskPhone masks phone numbers while keeping the country code and last digits.

func MaskToken

func MaskToken(token string) string

MaskToken masks session tokens or API keys, showing the first and last 4 characters if length > 8.