Best unstructured data masking and PII redaction tools in 2026

Redact, tokenize or replace?

Black boxes and tokens such as [NAME_1] are fine for disclosure, but they break parsers, tests and models. For test data and AI training, look for realistic replacement values that keep formats valid.

Is each person replaced the same way everywhere?

A customer called one name in the PDF and another in the email thread, or in the database, breaks tests and agent evaluations. Check consistency across files, runs and the tables the documents belong to.

Which files does it really handle?

Scanned PDFs need OCR, emails carry attachments and quoted threads, and archives mix formats. Some services inspect PDFs and Office files without being able to rewrite them.

Where do your documents go?

Cloud APIs need your files sent to them. If documents must stay inside your network, check for self-hosted or air-gapped deployment.

Synthesized

Masks PDF, DOCX and PPTX files including scans, mailboxes with attachments, Slack exports, chats, tickets, call transcripts, clinical notes, JSON, XML and logs under the same policy as your database tables. Each person gets one realistic replacement in every file of a run, files can share replacements across an archive, and output is checked against labelled samples. It also generates synthetic documents, such as bank statements, pay stubs and lab reports, with true-value JSON. Runs on-premises, including air-gapped sites, or as SaaS.

Watch for: document support is delivered with Synthesized engineers today rather than self-serve. Try it on 50 of your own documents in 48 hours.

Tonic Textual

Detects entities with NER models in 50+ languages and either redacts them or replaces them with synthetic values that fit the context, across documents, images and audio. Replacements can match Tonic Structural's masked database values when both use the same seed. Self-serve, with a free trial and pay-as-you-go pricing.

Watch for: EML and MSG files are supported only for datasets that write JSON output.

Limina (formerly Private AI)

Renamed from Private AI in 2026. Detects personal data in text in 53 languages, and in audio, files and images, and returns labels or, in beta, context-aware synthetic replacements. Usually deployed as a container in your own infrastructure.

Watch for: email formats are not listed and cross-document consistency is not stated.

Presidio

An open-source framework, now run by the community under the Data Privacy Stack organisation after moving from Microsoft. Combines NER models, regular expressions and rules, with operators to replace, redact, hash, mask or encrypt, and an image redactor that uses OCR.

Watch for: you build and run the pipeline yourself, its FAQ says it cannot guarantee finding all sensitive data, and the image redactor is in beta.

Google Cloud Sensitive Data Protection

Formerly Cloud DLP. De-identifies text, CSV files and images with redaction, masking, hashing, format-preserving or deterministic encryption, bucketing and date shifting, and can write de-identified copies of Cloud Storage files.

Watch for: it inspects PDF and Office files but cannot redact inside them, and realistic surrogates come only from a word list you supply.

Amazon Comprehend

Detects and redacts personal data in English and Spanish text through batch jobs over S3, masking characters or replacing them with the entity type. Amazon Transcribe can redact personal data from call recordings.

Watch for: no native PDF redaction; AWS describes a reference architecture combining Textract, Comprehend and human review.

Azure AI Language

Detects personal data in PDF, DOCX and TXT files and returns a redacted document that keeps fonts, spacing and colours.

Watch for: synthetic replacement is in preview.

Protecto

Built for RAG and AI agent pipelines. Its classifier finds personal data in text, JSON, document chunks, chat logs and tickets, and replaces it with reversible, format-preserving tokens that stay the same for the same entity across systems.

Watch for: file formats are not named and synthetic replacement values are not stated.

Nightfall

Data loss prevention for SaaS apps and AI prompts. Machine-learning detectors scan Office and Google files, PDFs, images, CSV, JSON, Parquet and ZIP archives, and findings can be redacted, substituted or encrypted. A free plan covers 3 GB a month.

Watch for: it is built to find and stop leaks rather than produce masked datasets.

What are the best unstructured data masking tools?

For test data and AI training, where files must stay usable, Synthesized and Tonic Textual replace personal data with realistic values. For detection inside your own pipeline, Limina, Presidio, Google Cloud Sensitive Data Protection, Amazon Comprehend and Azure AI Language. For protecting data in apps and AI prompts, Protecto, Nightfall and Skyflow.

What is the difference between redaction and masking?

Redaction removes or blacks out a value. Masking replaces it with a realistic substitute in the same format, so documents still parse and tests still run. For test environments and AI training, masking with consistent replacements keeps data useful.

How do I mask PII in PDFs and scanned documents?

Scanned pages need OCR before personal data can be found. Then each value should be replaced in the file itself, not covered over. Synthesized does this inside your environment and can output image-only PDFs or searchable PDFs carrying the replacement values. See PDF and document masking.