The Region selector (top toolbar) swaps which country/region regex ruleset is layered on top of the always-on Global baseline (email, IP addresses, credit card numbers, generic dates). Only one region is active at a time to avoid cross-country format collisions (e.g. a bare 9-digit number shouldn't simultaneously be treated as a US SSN and something else).
The Persona selector swaps the Hard Block keyword set between Personal privacy terms and Business confidentiality terms.
Nothing here is saved. MaskFirst destroys all state on reload by design, so your Region/Persona choice resets every time you open the file. If you always work in one region or persona, open MaskFirst.html in a text editor, search for DEFAULT_REGION and DEFAULT_PERSONA near the top of the <script> block, and change the value — that becomes your new startup default.
Custom Dictionary (CSV)
Batch-import your own keywords, names, or project codenames. Download the template and fill it out using the "Keyword,Category" format. Category is optional — it defaults to CUSTOM if left blank. The system generates matching tags automatically (e.g. NAME_1, CUSTOM_1). Note: keyword values cannot contain commas — this will break CSV parsing. If a term itself contains a comma, use "Build Dictionary Online" instead.
Local AI Prompt Library
Ready-to-copy system prompts for local models (Ollama, LM Studio, etc.). Paste one of these ahead of your masked text so the model's own instructions also stay privacy-aware — reinforcing that nothing, including your prompt phrasing, needs to leave this machine.
Personal
For personal documents — reminds the model that names/contacts are tokenized and must stay untouched.
Business
For business documents — frames the content as confidential/trade-secret material.
Local AI (Ollama) Connection Setup
Don't have Ollama installed yet?
Download it from the official Ollama website and install it. Then open a terminal (Command Prompt / PowerShell / Terminal) and run the following command to install the default model: ollama run qwen2.5:3b
Why is this setting needed? And a risk warning
Ollama blocks all web page access by default (a security protection). You need to add an "environment variable" named OLLAMA_ORIGINS set to * so Ollama allows this local MaskFirst page to connect.
⚠️ Security risk notice:
Setting the origin to * allows any web page to call your local model. This only affects your own user account and doesn't require administrator rights, but it does carry some risk of abuse by other malicious pages.
We strongly recommend fully quitting Ollama from the system tray when you're not using this tool, or removing the environment variable afterward.
Setup steps (one-time; persists across reboots after that)
1
Quit Ollama first
Find the Ollama icon in your system tray (bottom-right, near the clock), right-click it, and choose "Quit Ollama" to fully close it.
2
Open your OS's "Environment Variables" dialog
Windows: click Start, search "Edit environment variables for your account", and open it. Or press Win + R, type sysdm.cpl, press Enter, then "Advanced" → "Environment Variables".
macOS/Linux: set OLLAMA_ORIGINS=* in your shell profile (e.g. ~/.zshrc) or launch Ollama with the variable set for the session.
3
Add a new entry under "User variables"
Click "New..." under the upper half (your personal account variables) and enter:
Variable nameOLLAMA_ORIGINS
Variable value*
Click OK, then OK again to close the dialog.
4
Restart Ollama
Reopen the Ollama app from the Start menu, wait for the tray icon to appear, then come back here and click "Test Connection" to confirm.
↩
How do I undo this later?
Repeat step 2, find the OLLAMA_ORIGINS entry under "User variables", select it, click "Delete", and restart Ollama.
i
How do I stop Ollama from auto-starting?
On Windows: open Task Manager (right-click the taskbar) → "Startup apps" tab → find Ollama → set to "Disabled" so it won't launch in the background at boot.
Connection & Model Settings
※ Make sure you've pulled this model via Ollama. Developers can edit these default options directly in the source (MaskFirst.html).
PII Rule Guide
MaskFirst uses a two-layer system to detect sensitive personal and business data — this section explains how each layer works and where its limits are. The rules and keywords actually active for your current Region/Persona, and every add/edit/delete action, now live in Manage Custom Protection Rules — including the built-in ones, not just your own custom additions.
Not sure this file is actually safe? Ask an AI.
MaskFirst is a single HTML file — no server, no background network calls. You don't need to read code yourself: paste the entire MaskFirst.html source into any AI (ChatGPT, Claude, etc.) and ask it directly: "Does this page send any user input anywhere?" Let the AI verify it for you, instead of just taking the developer's word for it.
How do I add my own PII rules and Hard Block keywords?
You don't need to hand-edit the HTML source — use the "Manage Custom Protection Rules" button in the toolbar instead:
Click "Manage Custom Protection Rules" in the toolbar, then switch to the "Hard Block Keywords" or "Regex Rules" tab.
Click "+ Add Row" to add a row directly in the table, or click any row's fields to edit them in place — including the built-in rows for your currently selected Persona/Region, not just your own custom ones (regex rules are validated for syntax and ReDoS risk on save). Edited or deleted built-in rows show a "Revert to Default" option, or you can re-add a deleted one from the "removed from defaults" list below the table. For bulk changes, you can instead download that tab's CSV template, fill it in, and import it, choosing "Merge with Existing" or "Replace All" (this only ever affects your custom layer).
To share your customizations with a colleague or reuse them on another machine, expand "Advanced Settings" (desktop only) in the same panel and click "Export Config File" to download maskfirst.config.js; to apply it later, click "Import Config File", pick that file, and confirm the summary. Note: this is a manual import — it does not apply automatically on refresh or the next time you open this file, so you'll need to re-import it each time.
To discard manual edits or imported settings and restore the built-in defaults, open "Manage Custom Protection Rules", expand "Advanced Settings" (desktop only), and click "Reset to Defaults".
Layer 1: Static Rule Scan (Regex + Hard Block Keywords)
Runs the instant you paste text, using fixed-format rules (e.g. SSNs, IBANs, phone numbers) to catch personal data that follows a describable pattern. Fast and precise, but it can't catch free-form content — like names — that has no fixed format.
Layer 2: Local AI Semantic Scan (optional, requires Ollama)
Runs a small language model on your own machine to catch free-form content regex can't describe (e.g. address variations). Name detection isn't reliable yet — add common names to your Custom Dictionary instead of relying on this layer alone.
Hard Block: why does some content lock copying instead of just being masked?
Extremely sensitive terms (from your currently selected Persona) aren't safe to send even after masking — the surrounding context alone can be enough to identify who it's about. Content matching these terms locks the copy function entirely, instead of being replaced with a tag.
The regex rules and hard-block keywords actually active right now — including add/edit/delete and reverting a built-in row to its default — all live in Manage Custom Protection Rules.
Sensitive Information Block Warning
MaskFirst detected text that may contain extremely sensitive information. To protect the people involved, copy/export has been temporarily locked.
Block Reason(s)
If you've confirmed this information is safe to release, or believe this is a false positive, you can force-unlock it.
Custom Dictionary Manager (View / Edit / Build)
Type directly into the table below, or copy two columns from Excel and paste into any cell — the table expands automatically.
Empty rows are ignored when you apply.
#
Keyword (required)
Category (optional, e.g. NAME)
Delete
Manage Custom Protection Rules
Shows the keywords active for the currently selected Persona (plus your custom layer). Add or edit rows directly, or batch-import a single-column CSV (one keyword per row); built-in rows can be reverted to their default or deleted.
English
繁體中文
Actions
Shows the rules active for the currently selected Region (plus Global and your custom layer). Add or edit rows directly, or batch-import a 4-column CSV (TypeTag,RuleName,Pattern,ExampleText); the Pattern column accepts a bare pattern or a full /pattern/flags literal, validated for syntax and ReDoS risk on save. Built-in rows can be reverted to their default or deleted.
Tag
Name
Pattern
Example
Actions
No {{TEXT}} placeholder found — the AI won't receive the actual document text.
No {{TEXT}} placeholder found — the AI won't receive the actual document text.
No {{TEXT}} placeholder found — the AI won't receive the actual document text.
Advanced Settings: Import / Export Config File▾
Import Mode
Tag Reference
Save which tag was used for each original value, then import it later so the same value gets the same tag next time.
Currently has 0 record(s)
Export
Import
Set an Export Password
If you forget the password, the file cannot be recovered.