Alcatraz finds PII in Go.

A Go library that scans text for PII locally, with no service and no network call. Import it, call Analyze, get verified matches back with a confidence score. 52 entity types across 13 countries.

View on GitHub (opens in a new tab)Get started free
install with go get
$ go get github.com/hoophq/alcatraz

Four lines of Go.

Analyze returns every match with its entity type, offsets and score. Set a threshold and the shape-only matches fall away while the checksum-verified ones stay.

alcatraz.go
import "github.com/hoophq/alcatraz"

eng := alcatraz.NewEngine()
text := "Card 4532 0151 1283 0366, reply to jane@example.com"
matches := eng.Analyze(text, alcatraz.Options{})

for _, m := range matches {
    fmt.Println(m.EntityType, m.Text, m.Score)
}

Verified matches

2 of 2 returned

Threshold
  • CREDIT_CARD1.00

    4532 0151 1283 0366 · Luhn checksum

  • EMAIL_ADDRESS0.50

    jane@example.com · Pattern, no context word

A context word lifts a match: email: jane@example.com scores 0.85.

Import, scan, verify.

Pattern recognizers find the candidates; validators prove the structured ones before anything is flagged.

  1. Import the package

    Add it to your Go code directly. No service to deploy.

    import "github.com/hoophq/alcatraz"

  2. Scan for PII

    Pattern-based recognizers scan the text for identifiers, in linear time on Go’s RE2.

    eng.Analyze(text, alcatraz.Options{})

  3. Verified matches only

    Structured identifiers pass a checksum before they are flagged, and score 1.0 when they do.

    CREDIT_CARD 1.00

Built for Go services.

The same engine ships as a CLI for files, stdin and diffs. Detected values are always masked in its output.

alcatraz CLI
# same engine, same zero-network scan
$ alcatraz scan secrets.log app.log    # files, line by line
$ git diff | alcatraz diff             # only the lines a diff adds
$ pbpaste | alcatraz scan              # pasted text from stdin
$ alcatraz scan -json report.log       # machine-readable, masked too
# exit codes: 0 clean, 1 findings, 2 error

  • Zero network calls

    Runs inside your process: no sidecar, no round trip, no third party. The core imports nothing outside the Go standard library.

  • Verified, not guessed

    26 of its 53 recognizers carry a real checksum validator. A 16-digit number that fails Luhn is dropped, not flagged.

  • Benchmarked against Presidio

    About 10 to 105 times faster than Presidio’s analyzer in the repo’s reproducible benchmark, with entities Presidio does not ship.

  • Read the numbers yourself

    Benchmarks and parity (opens in a new tab) on GitHub. Numbers vary by machine.

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Mask PII everywhere it moves.

hoop masks sensitive data across every protocol it proxies, databases, shells and cloud consoles, with the same verified detection built into Alcatraz.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

add it to your module
$ go get github.com/hoophq/alcatraz
# Go 1.24+, standard library only