Statement anonymiser — mask account numbers & balances before you share

Why you probably need this

A bank statement is a compact bundle of highly sensitive data: account number, sort code / routing number, IBAN, name and address of the account holder, and a running balance that reveals income, spending pattern and — critically — how much money the account holds today. You almost never want to share all of that at once.

But you also frequently have to share something. Common examples: sending a statement to your accountant for expense categorisation (they need the transactions, not your balance), to a prospective landlord as proof of rent-paying capacity (they need the income line, not your account number), to an insurance underwriter (they need the direct-debit history, not your card), or as evidence in a small-claims dispute (you want the transaction in question, not your entire financial life).

The default workflow — screenshot it, open in Preview, scribble over the numbers with a black rectangle — is fragile. Preview's annotations aren't real redactions: any competent recipient can slide the rectangle aside or delete it. This tool applies image- level redaction: we render each page to a canvas, draw solid black rectangles over the sensitive tokens, and write a fresh PDF from those canvases. The underlying text objects are gone. You can't select them, search them, or extract them with a developer tool.

What we mask, and how we find it

The tool ships with five toggles. All five default to safe — the ones a normal person would want — with one nuclear option off by default:

• Account & card numbers. Any pure-digit run 8–20 characters long (with or without spaces and hyphens), 4×4 card-number groupings like 4111 2222 3333 4444, and pre-masked forms like XXXX-1234.
• IBAN & BIC/SWIFT. IBANs are 2-letter country code + 2 check digits + 11–30 alphanumerics (e.g. DE89 3704 0044 0532 0130 00). BIC/SWIFT codes are 8 or 11 alphanumerics; we mask both.
• Sort code / routing number. UK sort codes in the 00-00-00form and US 9-digit ABA routing numbers (when a nearby word like “routing” or “ABA” disambiguates them from a random long number).
• Balance amounts.On any line whose text contains the word “balance” (or common abbreviations like b/f, c/f, “brought forward”, “closing bal”), we mask the amount tokens on that line. This catches the opening & closing balance rows most statements have at the top, the running balance column when it's labelled, and the “available balance” block at the bottom.
• All transaction amounts (off by default). Nuclear option: mask every currency figure on every row. Useful when you want to preserve merchant names / descriptions as proof of a subscription or transaction, without disclosing what you paid.

Personal names and addresses are deliberately not masked automatically — they don't have a machine-detectable pattern, so we'd either miss half of them or false-positive on merchant names. If you need to hide a name, use the “all amounts” level of paranoia plus a manual redaction pass in Preview or Adobe Acrobat after downloading.

How the redaction actually works (technical)

For each page in the PDF, we do the following in your browser:

1. Render the page at 2× DPI to an off-screen HTML canvas using pdf.js — same engine your browser uses internally.
2. Ask pdf.js for the text contentof the page: the actual text items and their positions in the page's coordinate system.
3. For every token, run our detection function. It considers the token AND the joined text of its whole line (so “12,345.67” gets masked when the line says “Closing balance” but not when it's a routine transaction row).
4. Convert each sensitive token's coordinates to canvas space and paint a solid black rectangle over it — sized generously so there's no bleed at the edges.
5. Encode the redacted canvas as a PNG and embed it in a new PDF built with pdf-lib.

The output PDF is image-only. That's a deliberate trade-off: the file will be a bit larger than the original and won't be searchable, but there is no residual text layer that could leak the redacted content. Compare that with the “draw a black box on top” approach used by most casual annotators, where the underlying text remains fully intact one z-index below.

Sharing anonymised statements — good practice

A few habits worth building around statement sharing:

• Anonymise before you email.Not after — once an email is sent, the original bytes are on someone else's server forever. Redact first, then attach.
• Prefer a portal or shared-drive link with expiry. Email attachments live in inboxes indefinitely. A shared link can be revoked.
• Give the least information required.A landlord asking for proof of income doesn't need six months of running balance. Redact the balance column, keep the salary credits.
• Verify the redaction visually.The tool shows you thumbnails of the first four redacted pages before you download — glance at them. If a balance number leaked through, re-run with “all transaction amounts” enabled.

After you redact — reconciling & converting

The anonymised PDF you download is useful for sharing but not for further processing (it's an image PDF, so extracting the transactions from it needs OCR). If you also need a machine- readable version of the original statement — CSV, Excel, QuickBooks .qbo, Xero CSV or Sage — run the un-redacted PDF through our main bank statement converter in a private step, then anonymise the resulting CSV separately (open in Excel, delete the balance column, save). And if the source PDF is password-protected, unlock it first with our PDF password remover.