💙 Supporting healthcare non-profits: Metadataloop is free for 6–12 months. Contact Us to get started.
Free Online Tool

PII Detector & Data Masking SQL Generator

Paste a schema, detect likely PII columns, get masking SQL instantly.

Open the PII Detector →

Overview

Before copying production data into staging or dev, sensitive columns need to be masked. MetaDataLoop scans your CREATE TABLE schema for 15+ categories of likely-PII columns by name heuristics — emails, names, SSNs, cards, addresses, health data — then generates dialect-aware UPDATE statements to mask them.

What you get

✓ INCLUDED
Detects direct identifiers: email, phone, SSN, passport, driver's license
✓ INCLUDED
Detects financial data: credit cards, bank accounts, IBAN, routing numbers
✓ INCLUDED
Detects personal data: names, username, date of birth, gender, address
✓ INCLUDED
Hash-based masking for names/emails, partial masking for cards/SSNs/phones
✓ INCLUDED
Dialect-aware SQL for Postgres, MySQL, Snowflake, and SQL Server

Type detection reference

Sample values and the dialect-native type they map to.

Sample valueInferred type
email, name columnsMD5() hash (HASHBYTES on SQL Server)
phone, SSN, card, accountPartial mask — last 4 digits kept
address, IP, genderFixed placeholder value
password, secret, tokenFull redaction → [REDACTED]
date of birthSet to NULL

Example

Input
CREATE TABLE customers (
  id SERIAL PRIMARY KEY,
  first_name VARCHAR(50),
  email VARCHAR(255) NOT NULL,
  phone VARCHAR(20),
  ssn VARCHAR(11)
);
Output
UPDATE "customers"
SET
  "first_name" = MD5("first_name"),
  "email" = CONCAT(MD5("email"), '@masked.example.com'),
  "phone" = CONCAT('XXX-XXX-', RIGHT("phone", 4)),
  "ssn" = CONCAT('XXX-XX-', RIGHT("ssn", 4));

Frequently asked questions

Does this run against my real database?
No — it only analyzes the schema text you paste and returns SQL for you to review and run yourself.
Is name-based detection reliable enough for compliance?
It catches most conventionally-named columns, but always have a human review the report before running masking SQL against real data for GDPR/CCPA/HIPAA purposes.

Try it now

No signup, no install — runs entirely in your browser.

Open the PII Detector →

⚠ Confirm Delete