Anonymize CPFs in List

You have to send a customer list to another team, attach a report to a support ticket or paste part of a spreadsheet into a chat, and the full CPF cannot go along. Paste the block of text and every CPF comes out as 123.***.***-09, with consistent punctuation even when the source had none. The result updates as you type.

Here is the part nobody mentions: the mask keeps the first three digits and the last two, and those last two are the check digits, computed from the first nine. Six digits stay hidden, a million combinations, but only about ten thousand of them are consistent with the check digits left in plain sight. That is pseudonymization: it lowers exposure, it does not make the number unrecognizable.

Review the output, because the search looks for eleven digits in a row and never verifies that they form a valid CPF. A Brazilian mobile number with area code also has eleven digits and becomes 119.***.***-21. An unpunctuated CNPJ, fourteen digits, comes out worse: the first eleven get masked and the rest trails behind; with dots and slash it passes untouched. The mask is fixed, and everything happens in your browser.