How to anonymize an Excel file
- Open the file. Excel, OpenDocument or CSV. Pick the sheet if the workbook has several.
- Check the method of each column. Emails, names and IDs are proposed as pseudonyms, phone numbers and IBANs as masked values, dates of birth as years and postcodes as a prefix. Change anything you like.
- Set a key if you use pseudonyms: your own long passphrase or a generated random key. Copy it somewhere safe if you will process more files later.
- Mark the quasi-identifiers and read the k-anonymity check. If many rows are unique, generalise more (year instead of month, fewer postcode digits) or drop a column.
- Download the Excel file. It contains the transformed data, a “Method” sheet that documents every column and the algorithm, and the list of groups below your target k.
Private by design: no upload
Anonymizing data on a website that uploads it first defeats the purpose. Here the file is read and transformed by JavaScript inside your browser, in a background worker, and the pseudonym key is only kept in memory while the page is open. Nothing is sent to a server and nothing is stored in your browser.
You can check it in the Network tab of the developer tools, or go offline after the page has loaded and keep working.
The methods and when to use them
- Keyed pseudonymReplaces each value with a code such as EMA-3f9a2c7b1e4d8a60, computed with HMAC-SHA256 and your key. The same value always gets the same code, so you can still count, group and join files. Use it for names, emails, customer numbers or national IDs that you need to link.
- MaskKeeps the last characters and hides the rest (********1332). Useful when someone must recognise a value without seeing it whole, like the end of an IBAN or a phone number.
- RedactReplaces every value with a fixed text. For free-text notes, addresses or anything you do not need at all but want to keep as a column.
- GeneraliseMakes a value less precise: a date of birth becomes its year or month, an age or salary becomes a range (30–39), a postcode keeps its first digits (28***). This is the main way to raise k.
- ShuffleReorders the values of one column at random, so totals and distributions stay the same but the link with each row is broken. Good for statistics and test data.
- DropRemoves the column from the output. The safest option for anything the recipient does not need.
Pseudonymisation is not anonymisation
The two words are often mixed up, and the difference matters under the GDPR. Pseudonymisation replaces identifiers with codes, but the data can still be attributed to a person with additional information, such as the key or the original file. The GDPR defines it in Article 4(5) and Recital 26 states that pseudonymised data should still be considered information about an identifiable person. In other words, it remains personal data: the GDPR still applies, although pseudonymisation is recognised as a useful safeguard.
Anonymous data is information that can no longer be related to anyone, taking into account all the means reasonably likely to be used, including other data the recipient may have. Only then does the GDPR stop applying. Removing names is rarely enough: a combination such as date of birth, postcode and gender can be unique for many people.
This tool gives you the building blocks and a risk indicator, but it cannot tell whether a particular result is anonymous, and using it does not make a processing operation compliant. That assessment depends on the data, the purpose, the recipient and the other information available. When in doubt, ask your data protection officer or follow the guidance of your supervisory authority.
Why a key, and not a plain hash
A plain SHA-256 or MD5 of an email or a phone number looks random, but it is easy to reverse: an attacker hashes a list of all likely emails or every possible phone number and compares. With a keyed HMAC, the same calculation is impossible without the secret. Your passphrase is stretched with PBKDF2-SHA256 (200,000 iterations, a fixed public salt) so that a short passphrase is harder to guess; a generated random key of 32 bytes is better still. The “Method” sheet records a key check value: if two files show the same check value, they were made with the same key, but the value does not reveal the key.
What k-anonymity tells you
Choose the quasi-identifiers, the columns that are harmless alone but identifying together. The table is k-anonymous when every combination of their values appears in at least k rows. The check runs on the transformed values, so you can see the effect of generalising: turning dates of birth into years and keeping two postcode digits usually turns hundreds of unique rows into groups of several people. Rows in groups smaller than your target are listed so you can generalise further or remove them.
k-anonymity is a well-known risk measure, not a guarantee: a group where everyone shares the same diagnosis still reveals it (that is what l-diversity addresses), and data published by others can be linked with yours.
Other ways to do it
Excel has no built-in anonymization. People usually replace values by hand, use RAND() with sorting to shuffle, or hash with a VBA macro. There are also browser extensions, Excel templates from data protection authorities and Python libraries. This page puts the common methods, a consistent keyed pseudonym and a k-anonymity check in one place, without installing anything.
Known limitations
- Free-text columns (comments, notes, email bodies) can contain names, phone numbers or health details inside the text. They are not scanned: redact or drop them.
- Rare values remain identifying even when generalised, for example a very high salary or an unusual job title in a small company.
- The result can be linked with other datasets that share quasi-identifiers; the k-anonymity check only looks at this file.
- Shuffling keeps each column’s distribution, so very rare values are still visible.
- The live check treats shuffled columns as unshuffled; the report inside the downloaded file uses the real output.
- Dates written as text are read as day/month/year or month/day/year depending on the values; if a column is ambiguous, US order (month/day) is assumed on this English page.
- One sheet per file. Formatting, formulas, comments and other sheets are not copied to the output.