BlurGuard's auto-detect feature scans every webpage for nine categories of personally identifiable information (PII). When it finds a match, it blurs the value instantly — no manual action needed. Here's a deep dive into how the detection engine works.
The nine PII categories
BlurGuard detects these types of sensitive data:
- Email addresses — Standard email format (local-part@domain). Requires 5+ characters in the local part for confidence.
- Phone numbers — Various international formats. Requires 7+ digits to reduce false positives.
- Credit card numbers — 13–19 digit sequences validated with the Luhn algorithm.
- SSN (Social Security Number) — Exactly 9-digit sequences matching the standard format.
- API keys — 16+ character tokens matching common API key patterns (e.g.,
sk_live_,pk_test_). - JWT tokens — Base64-encoded JSON Web Tokens, 24+ characters, identified by the three-part dot-separated format.
- Passwords — Form fields and text matching password detection patterns.
- Private keys — Cryptographic key blocks matching
-----BEGIN ... PRIVATE KEY-----format. Always detected at maximum confidence. - Connection strings — Database URLs and connection strings (e.g.,
postgres://,mongodb+srv://).
How detection works
The detection engine uses regex patterns with confidence scoring. Each detector returns a confidence value between 0 and 1. A match is only blurred if its confidence exceeds the threshold (default: 0.8, configurable in Settings).
This means borderline matches — like a 9-digit number that could be an SSN or just a phone extension — won't be blurred unless the pattern is strong enough. You can lower the threshold to catch more matches, or raise it to reduce false positives.
Detection priority
When multiple detectors match the same text, BlurGuard uses priority ordering to pick the most specific category:
private key → connection string → API key → token → credit card → SSN → phone → email
For example, a -----BEGIN RSA PRIVATE KEY----- block won't be tagged as just a "token" — it gets the more specific "private key" label.
What gets scanned (and what doesn't)
BlurGuard walks all visible text nodes on the page using a TreeWalker. It skips these elements to avoid false positives and performance issues:
<script>— JavaScript code<style>— CSS rules<input>,<textarea>— Form fields<code>,<pre>— Code blocks<iframe>,<canvas>,<svg>,<math>
Already-blurred elements are also skipped, preventing double-blurring.
Real-time scanning with MutationObserver
Auto-detect isn't a one-time scan. BlurGuard uses a MutationObserver that watches for:
- New child nodes added to the DOM (e.g., dynamic content loaded via AJAX)
- Character data changes (e.g., text updated by JavaScript)
Changes are debounced at 250 milliseconds — if multiple mutations happen in quick succession (like a rapid API response), BlurGuard waits for the dust to settle and then scans once. This keeps performance smooth even on highly dynamic pages.
Enabling and configuring auto-detect
There are several ways to toggle auto-detect:
- Click ◉ Auto on the floating toolbar
- Press
Alt+Shift+A(global keyboard shortcut) - Flip the toggle in the popup
- Enable it in Settings
Click the ▾ caret next to the Auto button to open the category dropdown. Here you can check or uncheck individual categories. For example, you might enable email and phone detection but disable API key detection on a developer dashboard where API keys are expected to be visible.
Adjusting the confidence threshold
In Settings, you'll find a confidence threshold slider (0–1). The default is 0.8:
- Lower (0.5–0.7): More aggressive detection, catches more matches, higher chance of false positives
- Default (0.8): Balanced — catches clear PII while avoiding most false positives
- Higher (0.9–1.0): Conservative — only blurs very high-confidence matches
Recommendation
Start with the default 0.8 threshold. If you notice data leaking through that should be caught, lower it. If you see too many false positives (like product codes being blurred), raise it.
Auto-detect vs. keyword lists
Auto-detect and keyword lists are complementary features:
- Auto-detect catches known patterns (emails, cards, tokens) — things with a predictable format
- Keyword lists catch custom values (project codes, client names, internal URLs) — things only you know are sensitive
Use both together for complete coverage. Keyword rules take priority over PII detection, so if a keyword matches, it's always blurred regardless of the PII threshold.
Privacy: all processing is local
Auto-detect runs entirely in your browser's content script. No text is sent to any server, no API calls are made, and no data leaves your device. The detection patterns are hardcoded in the extension — there is no cloud component.
Everything runs locally. No text is sent to any server. The detection patterns are hardcoded in the extension — there is no cloud component.
