halilneed
TREN

Turkish PII masking tool

Before you send text to ChatGPT or another AI tool, mask Turkish national ID numbers (TCKN), IBANs, phone numbers, emails and card numbers here. Masking runs in your browser; the text is not sent anywhere from this page. When the answer comes back, you can turn the labels back into the real values.

Runs in
Your browser. The text never reaches a server.
Finds
TCKN, IBAN, phone, email, card number and the names you list
Validation
TCKN checksum, mod 97 for IBAN, Luhn for cards
Files
CSV, TSV, TXT. You can also paste cells from Excel.
Price
Free, no sign-up

Mask your text

What to mask

Separate with commas. Rules cannot find names; what you type here becomes [AD]. Case and the Turkish i, ı, İ, I are ignored.

Options

Restore the answer

Paste the AI tool’s answer here. Labels such as [TCKN_1] or [AD_1] turn back into the values you masked in this tab. The mapping lives only in this tab’s memory and is gone when you reload the page.

How to use it

  1. Paste text or open a CSV or TXT file. The masked text updates as you type.
  2. Add the names the rules cannot find to “Names and words”: customers, employees or companies.
  3. Copy the masked text and send it to the AI tool. Read it once first; a name that is not on your list, or an address, may still be there.
  4. Paste the answer into “Restore the answer”. The labels turn back into the real values.

Using it with Excel

Select cells in Excel, copy them and paste them into the Text box. Cells arrive separated by tabs and rows by line breaks, and the tool keeps both. Copy the masked text and paste it into a cell in Excel, and the table comes back in the same layout.

You can also open a CSV file directly. Older CSV files saved on Turkish Windows are read correctly too, including letters such as ş, ğ and ı. A downloaded CSV is saved as UTF-8 with a BOM so that Excel shows Turkish characters. XLSX files do not open; in Excel, use Save As and choose CSV.

What does it find?

The tool works with rules. The people and numbers in the examples are made up.
Data How it is found Label
National ID (TCKN) 11 digits, not starting with 0. The checksum is explained below. Example: 10000000146 [TCKN]
IBAN TR and 24 digits, with or without spaces; mod 97 check. Other countries’ IBANs only if they pass the check. Example: TR33 0006 1005 1978 6457 8413 26 [IBAN]
Phone 10 digits after +90, 0090 or 0, with brackets, spaces, dots or hyphens. Without a prefix, only mobile numbers starting with 5. Example: 0532 111 22 33, (0212) 123 45 67 [TEL]
Email name@domain.tld. Example: ayse@example.com [EMAIL]
Card number 13 to 19 digits, only if they pass the Luhn check. Example: 4111 1111 1111 1111 [KART]
Names and words The list you type. Turkish suffixes stay: “Ayşe Yılmaz’ın” becomes “[AD]’ın”. [AD]

The labels are short Turkish words; [AD], [TCKN], [TEL] and [EMAIL] are the same as in my Turkish PII model. By default, 11-digit numbers and TR IBANs that fail validation are masked too, because a mistyped ID number can still point to a person. If order numbers and similar get masked by mistake, switch on “Only TCKNs and IBANs that pass validation”.

How is a Turkish national ID number validated?

A TCKN has 11 digits and cannot start with 0. The last two digits are computed from the ones before them:

  1. Multiply the sum of digits 1, 3, 5, 7 and 9 by 7 and subtract the sum of digits 2, 4, 6 and 8. The remainder after dividing by 10 is digit 10.
  2. The remainder of the sum of the first 10 digits divided by 10 is digit 11.

Example: 10000000146. The odd positions add up to 1 + 0 + 0 + 0 + 1 = 2, the even positions to 0. 2 × 7 − 0 = 14, remainder 4: digit 10 is 4. The first ten digits add up to 6, remainder 6: digit 11 is 6. The number passes. Passing does not mean the number belongs to a real person; the check only catches typing errors.

IBANs use a different check: move the first four characters to the end, turn letters into numbers (A = 10, B = 11, …, Z = 35), and the remainder of that number divided by 97 must be 1. A Turkish IBAN has 26 characters: TR, two check digits, a five-digit bank code, one reserved digit and a 16-digit account number.

Masking, pseudonymisation and anonymisation

These three are often confused.

  • Masking: replacing a value with a label. With a plain label such as [TCKN] the value leaves the text, but the rest of the text (the event, a date, a place, a job title) can still identify the person.
  • Pseudonymisation: replacing a value with a label whose original is kept somewhere. The reversible labels in this tool ([TCKN_1]) work this way. As long as you hold the mapping, the data can be linked back to a person.
  • Anonymisation: in the words of KVKK, the Turkish data protection law, making personal data impossible to associate with an identified or identifiable person, even when matched with other data. Neither plain masking nor pseudonymisation gets there on its own.

This tool reduces the personal data you send out; it does not by itself make a process compliant with KVKK or GDPR. This page is not legal advice; decide with your legal team. The personal data and AI guide shows how to decide what to mask and what to keep in-house.

Limits

  • It does not find names that are not on your list, addresses, health information, licence plates or dates of birth. For names and addresses in free text, use my Turkish PII detection and masking model: it has 53 labels, runs locally on a CPU and can be tried in the browser.
  • It does not recognise 10-digit Turkish tax numbers separately; one that starts with 5 may be labelled as a phone number.
  • To see which categories of personal data a text contains, the Turkish KVKK classifier flags 24 of them.
  • The rules are deliberately simple. Read the masked text before you send it.

Questions

Is my text sent to a server?

No. Masking is done in your browser by the script on this page, and the script makes no network requests. Page visits are counted in aggregate with GoatCounter, without cookies; the text you type is neither counted nor stored.

Is this enough before I send text to ChatGPT?

Mostly yes for numbers and the names on your list, no for the rest of the text. The event itself, an address or a job title can still identify a person. If your organisation uses it, decide first which texts should never be sent at all.

How does restoring work?

With reversible labels on, each distinct value gets a numbered label; the same phone number appearing twice becomes [TEL_1] both times. The mapping lives only in this tab’s memory. Labels in the answer are replaced with the real values from it. Reloading the page deletes the mapping.

Can I open an Excel file directly?

XLSX does not open; CSV does. In Excel, use Save As and choose CSV, or copy the cells and paste them into the Text box.

Does it cost anything or need an account?

No. The tool is free and needs no account.