How auto-detect decides what to flag

Step one: recognize the text

The image is passed to an open-source text recognition engine running as WebAssembly inside the tab. It returns words with bounding boxes, grouped into lines. Nothing about the image leaves the browser during this step.

This step is the weak link, and it fails in predictable ways: small fonts, low contrast, unusual typefaces, text over a busy background, handwriting, and anything rotated or curved. On a crisp screenshot it performs well. On a photograph of a thermal receipt it performs poorly.

Step two: match the six rules

Recognized words are rejoined into lines, then scanned for these patterns. There are exactly six, and there are no others.

Names, addresses, license plates, faces, usernames, workspace names, and job titles are not in this list. They are not detected at all in this version, and any page on this site that implies otherwise would be wrong.

Why a card number needs a checksum

The rule for card numbers is not just a digit count. A candidate must pass the Luhn checksum, the same algorithm a payment terminal uses to reject a typo. That eliminates invoice numbers, order references, and timestamps that happen to be thirteen to nineteen digits long.

The cost of that filter is the important part. A number that contains an OCR misread, a digit obscured by a fold in the paper, or a crop that cut off the last digit will not pass the checksum and will not be reported. Detection returning nothing is not evidence that a card number is absent — it is evidence that no well-formed number was found.

When two rules claim the same text

Patterns overlap. A card number can contain a digit run that looks like an SSN; a phone number can contain an area code that looks like part of an IPv4 address. Rather than merging claims, the tool resolves them by priority, and the stronger signal wins:

1. 1. API key
2. 2. Email
3. 3. Card number
4. 4. SSN
5. 5. US phone
6. 6. IPv4

A claim that overlaps an already accepted one is dropped, not combined. The result is that one region is never reported twice, which keeps the box count honest and prevents a single number from producing two stacked boxes with different labels.

What the box actually covers

Each match is mapped back to the recognized words that produced it, then grouped by line, and the line's bounding box is expanded by a few pixels on each side. Two consequences follow, and both are visible in practice.

Text that wraps across two lines produces two boxes, one per line, rather than one box spanning both. That is intentional — a single box spanning a line break would cover unrelated text in between.

A value split by unusually wide letter spacing can be rejoined with a space and fail to match. This is the most common cause of a missed email address in a real screenshot.

How to check a result

• — Compare the reported count against what you can see yourself. If the tool found fewer addresses than are visible on screen, the result is incomplete.
• — Use the type filter to isolate one category at a time. Turning a category off is faster than re-reading every box.
• — Review the exported file, not the editor. Zoom to actual size and check each box edge for a sliver of a character.
• — Assume a miss until you have checked. Detection is a time saver, not a verification step.