Skip to main content
The Blindfold CLI lets you detect and protect PII directly from the terminal. Pipe text, read files, or use batch mode for bulk processing.

Installation

npm install -g @blindfold/cli
Or run without installing:
npx @blindfold/cli tokenize "John Doe, john@example.com"

Configuration

Set API Key

# Save to config file
blindfold config set-key your-api-key-here

# Or use environment variable
export BLINDFOLD_API_KEY=your-api-key-here

Set Region

# Save default region
blindfold config set-region eu

# Or use environment variable
export BLINDFOLD_REGION=eu

View Configuration

blindfold config show

Clear Configuration

blindfold config clear
Config is stored at ~/.config/blindfold/config.json.

Global Options

Every command supports these global options:
OptionDescription
--api-key <key>API key (overrides env var and config file)
--base-url <url>Custom API base URL
--region <region>API region: eu or us (overrides env var and config file)
--jsonOutput raw JSON response
--quietOutput only the transformed text
Priority order for API key: --api-key flag > BLINDFOLD_API_KEY env > config file. Priority order for region: --region flag > BLINDFOLD_REGION env > config file. See Regions for data residency details.

Commands

detect

Detect PII in text without modifying it.
blindfold detect "Contact John Doe at john@example.com"

tokenize

Replace PII with reversible tokens.
blindfold tokenize "Contact John Doe at john@example.com"
# Contact <Person_1> at <Email Address_1>

detokenize

Restore original values from tokenized text.
blindfold detokenize "Contact <Person_1>" \
  --mapping '{"<Person_1>": "John Doe"}'
# Contact John Doe

redact

Permanently remove PII from text.
blindfold redact "My SSN is 123-45-6789"

mask

Partially hide PII with masking characters.
blindfold mask "Card: 4532-7562-9102-3456"
# Card: ***************3456

synthesize

Replace PII with realistic fake data.
blindfold synthesize "John Doe lives in New York"

hash

Replace PII with deterministic one-way hashes.
blindfold hash "john@example.com purchased item X"

encrypt

Encrypt PII with AES encryption.
blindfold encrypt "Secret: API key is sk-12345"

discover

Analyze text samples to discover what types of PII they contain.
blindfold discover "John Doe" "john@example.com" "+1-555-1234"

Common Options

All PII commands (except detokenize and discover) share these options:
OptionDescription
-p, --policy <name>Detection policy: basic, strict, gdpr_eu, hipaa_us, pci_dss
-e, --entities <types>Entity types to detect (comma-separated)
-t, --threshold <n>Minimum confidence score (0.0-1.0)
-f, --file <path>Read input from file
-b, --batchBatch mode: process each line as a separate text

Using Policies

# GDPR-compliant detection
blindfold tokenize "John Doe, john@example.com" --policy gdpr_eu

# HIPAA compliance
blindfold redact "Patient Jane Smith, SSN 123-45-6789" --policy hipaa_us

Region Selection

# Process in the US region
blindfold --region us tokenize "John Doe at john@example.com"

# Process in the EU region
blindfold --region eu tokenize "John Doe at john@example.com"

# Or set as default
blindfold config set-region us

Reading from Files

# Single text from file
blindfold tokenize --file input.txt

# Batch mode: each line is processed separately
blindfold tokenize --batch --file data.txt

Reading from stdin

# Pipe text
echo "John Doe, john@example.com" | blindfold tokenize

# Batch from stdin
cat emails.txt | blindfold tokenize --batch

JSON Output

blindfold tokenize "John at john@example.com" --json
{
  "text": "John at <Email Address_1>",
  "mapping": {
    "<Email Address_1>": "john@example.com"
  },
  "entities_count": 1,
  "detected_entities": [
    {
      "type": "Email Address",
      "text": "john@example.com",
      "start": 8,
      "end": 24,
      "score": 1.0
    }
  ]
}

Quiet Mode

Output only the transformed text, useful for scripting:
blindfold tokenize "John Doe" --quiet
# <Person_1>

Examples

Tokenize before sending to an LLM

# Tokenize user input
PROTECTED=$(blindfold tokenize "My email is john@example.com" --quiet)

# Send to AI (the AI never sees real PII)
echo "$PROTECTED" | your-ai-tool

Batch process a CSV column

# Process each line in a file
blindfold redact --batch --file customer_emails.txt --policy gdpr_eu --json

Discover PII types in your data

blindfold discover \
  "John Doe, 123-45-6789" \
  "Card: 4532-7562-9102-3456" \
  "Patient ID: ABC-123"

Need Help?

# General help
blindfold --help

# Command-specific help
blindfold tokenize --help