piihush
Fast PII and secret masking for AI applications. A Rust extension for Python that removes sensitive data from your text before it reaches an external model provider.
pip install piihushAI applications pass a lot of data to external providers: documents, user messages, tool results and logs. That data often holds email addresses, card numbers and API keys. piihush masks them first, and it's fast enough to run on every chunk, without adding noticeable latency to a pipeline.
I build AI systems for clients: RAG pipelines, support assistants and agents that call external model providers. In every one of them, the same question came up: what happens to the customer emails, phone numbers, card numbers and API keys that end up in prompts, retrieved documents and logs?
The tools I tried each fell short in a different way. Heavy NLP frameworks were accurate but too slow to run on every chunk of a high-volume pipeline. Simple regex scripts were fast to write, but their patterns could backtrack badly on crafted input, and once a value was masked there was no clean way to put it back in the model's reply. Most also pulled in large dependency trees I didn't want in production.
So I wrote piihush to fit that gap. The matching core is written in Rust with linear-time patterns, so it stays fast and safe on any input, and it ships as a Python package with no runtime dependencies. PrivacyGuard swaps values for tokens and restores them in the reply, so the model can still do useful work without ever seeing the real data. Name detection and LLM detection are optional layers on top, for teams that need more coverage.
The goal is simple: make masking cheap enough that it can run on every request by default, instead of being skipped when a deadline is close.
pip install "piihush[llm]"
from piihush.llm import PrivateChat
chat = PrivateChat("openai", model="gpt-4.1-mini")
reply = chat.send("Write a reminder to email jane@example.com")
# The provider receives: Write a reminder to email [EMAIL_1]
# You receive: a reply containing jane@example.comMasking
Detects emails, phones, cards, IBANs, API keys, JWTs, private keys, passwords and more. Linear-time matching means crafted input can't trigger catastrophic backtracking.
PrivacyGuard
Swaps values for tokens such as [EMAIL_1], so a model works without seeing them, then restores the real values in its reply.
PrivateChat
Wraps a chat with OpenAI, Claude, Gemini, DeepSeek, Grok, Ollama, llama.cpp or any OpenAI-compatible service. The provider only sees tokens.
Name detection
An optional BERT model finds names and places in free text, and runs on your own machine after one model download.
LLM detection
An optional LLM can flag extra values, with the rules always running alongside it. It can only add masking, never remove it.
Built for pipelines
Releases the GIL, runs batches across all CPU cores, and works with threads, fork() and pickling.
Measured on 3,000 English records of the independent ai4privacy pii-masking-400k dataset, kept apart from the data used to build the rules.
| Tool | PII masked | Ordinary words kept | Time per record |
|---|---|---|---|
| piihush NerMasker | 69.7% | 96.6% | About 160 ms |
| Presidio | 64.8% | 94.8% | 15 ms |
| piihush Masker | 48.6% | 98.2% | About 20 µs |
| scrubadub | 13.8% | 98.3% | 1.2 ms |
| pyveil | 13.1% | 100% | 0.3 ms |
| pii-veil | 10.7% | 100% | 0.2 ms |
No PII tool catches everything, so piihush works best as one layer of a privacy strategy, alongside access controls and review for highly sensitive data.
Selected for the XERJ Corpus Hub
Nov 2026XERJ is an open-source, AI-native search engine that gives coding agents the exact passage of code or documentation they need. Its Corpus Hub is a public index of proven code solutions that agents consult before writing their own, so they build on what already works instead of repeating old mistakes.
The XERJ team reviewed piihush's Python bindings and test suite, about 410 lines of Rust and Python with tests landing in the same commit, and selected the work for the hub. It is indexed under the project's MIT licence, with attribution to the author and a link back to the repository.
