Mask Personal Data in Vietnamese Text Online

Find and mask personal data in Vietnamese text: CCCD, tax codes, phones, bank accounts, cards, emails, BHYT, plates, names, addresses. Spans reported.

Result

Press “Run” to see the result.

Send a text (support ticket, chat log, contract excerpt, data for an LLM) and get every piece of personal data with its type, position, confidence and reason, plus the redacted text. Detected: e-mail, Vietnamese phone numbers, CCCD (12 digits with a valid province and century code), 9-digit CMND, tax codes (MST, check digit verified), bank account numbers (after STK / tài khoản / a bank name), payment cards (Luhn and card prefix), BHXH and BHYT codes, passport numbers, vehicle plates, dates of birth (after "ngày sinh"), IPv4 addresses, person names (after a title such as anh / chị / ông / bà / "họ tên", or capitalised words starting with a Vietnamese family name) and addresses (after "địa chỉ" / "thường trú" or a street address resolved by /v1/address-parse). URLs on request.

Modes: mask (keep a few characters: 090* * 456, *******3456, N. V. A.), label ([PHONE_1], the same value keeps the same number), remove, hash (HMAC-SHA256 with your key, stable tokens for joining data sets) and pseudonym (realistic fake values of the same shape, stable for a value and key), or detect to only list the spans. Choose types with types and the threshold with min_confidence.

Built for the Personal Data Protection Law 91/2025/QH15 (in force 1 January 2026) and Decree 356/2025/NĐ-CP: sensitive marks financial and health identifiers. It is a detection aid, not a compliance guarantee: names and addresses written unusually can be missed. Nothing is stored or logged.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/vn-pii-redact" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"Khách hàng Nguyễn Văn An, CCCD 079203001234, SĐT 0909 123 456, email an.nguyen@gmail.com, STK VCB 0071000123456.","mode":"mask"}'

const res = await fetch('https://apibox.io.vn/v1/vn-pii-redact', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "text": "Khách hàng Nguyễn Văn An, CCCD 079203001234, SĐT 0909 123 456, email an.nguyen@gmail.com, STK VCB 0071000123456.",
    "mode": "mask"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/vn-pii-redact",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"text": "Khách hàng Nguyễn Văn An, CCCD 079203001234, SĐT 0909 123 456, email an.nguyen@gmail.com, STK VCB 0071000123456.", "mode": "mask"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/vn-pii-redact');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"text":"Khách hàng Nguyễn Văn An, CCCD 079203001234, SĐT 0909 123 456, email an.nguyen@gmail.com, STK VCB 0071000123456.","mode":"mask"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Is it accurate for names?

Names after a title or a "tên / họ tên" keyword are reliable; free-standing names are found when they start with a Vietnamese family name, which can also match place or street names. Check the confidence and adjust min_confidence.

Can I re-identify hashed values?

With hash or pseudonym and your own key, the same value always gives the same token, so data sets can be joined; without the key the tokens cannot be reversed. Without a key, hashes are plain SHA-256 and guessable.

Does this make me compliant?

No tool alone does. It helps minimise and de-identify data as the law requires, but legal obligations (consent, records, security) remain yours.