What Paste Guard detects

This list is generated from the detector code in the extension, so it matches the version in the repository. Every detector can be switched off in the popup.

Secrets and keys

Detector	Placeholder	On by default	What it matches
API keys & secrets	`[API_KEY_1]`	Yes	Tokens that start with a known provider prefix (cloud, source hosting, payments, messaging and AI services, among others), secrets next to a label such as secret, token or password, JWTs, HTTP authorization headers, passwords in connection strings and curl commands, and private key blocks.

Identity

Detector	Placeholder	On by default	What it matches
Aadhaar numbers	`[AADHAAR_1]`	Yes	Twelve digits starting 2 to 9. Grouped as 4-4-4 is flagged; an unbroken number must also pass its check digit.
PAN numbers	`[PAN_1]`	Yes	Five letters, four digits, one letter.
US SSNs	`[SSN_1]`	Yes	Nine digits in the 3-2-4 shape with separators, excluding ranges that are never issued.

Contact

Detector	Placeholder	On by default	What it matches
Email addresses	`[EMAIL_1]`	Yes	Standard name@domain addresses.
Phone numbers (+91 / international)	`[PHONE_1]`	Yes	Numbers that start with a plus sign and a country code, and Indian mobile numbers written in two groups of five.
Phone numbers (local formats)	`[PHONE_1]`	No	Other local phone shapes. Off by default because ordinary numbers can look like phone numbers.

Payments

Detector	Placeholder	On by default	What it matches
Card numbers	`[CARD_1]`	Yes	Thirteen to nineteen digits that pass the card check-digit test. Repeated-digit strings are ignored.

Regional

Detector	Placeholder	On by default	What it matches
UPI IDs	`[UPI_1]`	Yes	A name, an at sign and the handle of a well-known UPI bank or app.
IFSC codes	`[IFSC_1]`	Yes	Four letters, a zero, then six letters or digits.
GSTIN numbers	`[GSTIN_1]`	Yes	Fifteen characters in the GST format, with its check character verified.
Bank account numbers (labelled)	`[BANK_ACCT_1]`	Yes	Nine to eighteen digits, only when a label such as account number or a/c no comes right before them.
IBANs	`[IBAN_1]`	Yes	Country code, two check digits and the account part, verified with the standard check.
UK National Insurance numbers	`[NINO_1]`	Yes	The UK National Insurance format, excluding prefixes that are never used.

How masking works

Each found value is replaced with a numbered tag. The same value gets the same number within one paste, so the text still reads sensibly: two mentions of one email both become [EMAIL_1], a second address becomes [EMAIL_2]. Numbers restart with every paste.

Limits

Detection is pattern based. It can miss formats it does not know and can occasionally flag something harmless; Ignore skips a value you choose. It reads text only, not images. It watches pastes on the supported sites, not typing or uploads, and it reads page text there to restore placeholders in replies. It is a safety net, not a guarantee.