Why Regex Alone Can't Catch Modern PII (and What Fills the Gap)

Where regex is strong

Well-formed identifiers with a check digit — cards passing Luhn, IBANs passing mod-97 — regex plus validator catches with near-perfect precision. API keys with recognisable prefixes (`sk-`, `ghp_`, `AKIA`) are similarly clean. These are the layers to keep.

Where regex is weak

• Names — the space of capitalised-bigram English strings is dominated by non-names.
• Phone numbers — a naive digit pattern grabs versions, ISBNs, coordinates and timestamps.
• Organisations without a legal suffix — 'OpenAI', 'The Guardian', 'Meta'.
• Addresses that don't fit the '123 Main Street' template.
• Any identifier that requires locale knowledge (Hungarian TAJ, Spanish DNI, UK NI number).

The NER alternative

A small transformer running in the browser via ONNX Runtime Web can hit 92–96% F1 on the CoNLL categories. Great — until you notice it's a 40–120 MB download, a 200–500 ms latency spike on first inference, and a battery hit on the user's laptop. In every real deployment we watched, the initial latency killed adoption inside the first week.

The pragmatic middle

PromptShielder's approach: strong regex where regex is strong; contextual cues (honorifics, salutations, verbs of interaction) to gate name detection so 'New York Times' does not trigger; a user-defined custom-terms list for the entities regex will never catch (project codenames, client aliases). No model download, no server call, no adoption cliff.

What we still recommend a WASM model for

• Regulated deployments where an auditor wants an ML-based control on record.
• Non-Latin-script inputs where regex quickly runs out.
• Batch pipelines where the latency is amortised.