How to redact a Social Security number before using AI
· Written and maintained by Nonimo
To redact a Social Security number before a document goes into an AI tool, take out all nine digits and leave a label where they were, so the sentence still reads and the number no longer exists in the text:
IRS truncation, for paper: 219-09-9999 → XXX-XX-9999
Before AI: SSN: 219-09-9999 → SSN: [SSN_1]The first line is the official American mask. A Treasury regulation, 26 CFR 301.6109-4, defines an IRS truncated taxpayer identification number as an SSN with its first five digits replaced by Xs or asterisks, in the format XXX-XX-1234, and allows it on statements furnished to another person, such as the employee’s copy of a W-2.
That mask was written for paper that a person reads. A chatbot is a different reader, and the second line is the version that suits it: the whole number gone, and a label that still tells the AI an SSN stood there. Both sample numbers in this guide come from the Social Security Administration’s own history, and further down you will see why.
The rest of this guide covers how to do it in every place an SSN hides, what the SSA, the FTC and state laws say about the number, and how an office that handles SSNs every day can make it automatic. For the full list of what else comes out of a file, start with the personal information to remove before AI.
How to redact a Social Security number: all nine digits, and a label
An SSN has a fixed shape. The SSA describes it as a three digit area number, a two digit group number and a four digit serial number, in groups of 3, 2 and 4. Since June 25, 2011, numbers are assigned at random, so the first three digits no longer point to a state, and the SSA does not assign area numbers 000, 666 or 900 to 999. That still leaves approximately 420 million numbers available for assignment.
That fixed shape is good news for redaction. A number that always looks the same can be found by a pattern, and a tool can replace every one of them in seconds, which is not true of names or job titles.
Why a label beats XXX or a black box
Typing XXX over the digits works for one person and fails for two, because the AI can no longer tell whose number was whose. A label such as [SSN_1] does both jobs: the client’s number becomes [SSN_1], the spouse’s becomes [SSN_2], and a question about filing jointly still makes sense.
The black box is the trap. A rectangle drawn over an SSN in a PDF usually sits on top of the text, and the digits come back the moment someone selects and copies the page. An AI tool that reads the file reads the text layer, not the picture. Our guide to redacting a PDF so the words are really gone tested exactly this on a claim memo.
One person, one label, every time
The label only helps if it stays the same. If the client is [SSN_1] in the intake note, she has to be [SSN_1] in the next question too, or the AI will treat two mentions of one person as two people. Keep your own short key of which label belongs to which file, on your computer and out of the chat.
And never build the label out of the number. A code such as Client 9999 looks harmless and hands the last four digits straight back. The label should say what the value was, an SSN, and nothing about what it said.
Dashes, no dashes, and a label in front
The same SSN can sit in one file as 219-09-9999 on a form and 219099999 in a payroll export. A search for one shape misses the other. Here are three lines as they came out of Nonimo’s engine on October 1, 2026, run as one text:
SSN: 219-09-9999 → SSN: [SSN_1]
SSN 078051120 → SSN [SSN_2]
Social Security number 219-09-9999 → Social Security number [SSN_1]The number that appears twice kept [SSN_1] both times. A number written with no label at all, such as a bare 219-09-9999 in the middle of a line, was covered too, under a reference label. In Word, a wildcard search for the dashed pattern finds the rest, and the Word guide gives the exact pattern.
Where an SSN hides in a file
The number rarely sits in the body of a letter. It sits in form fields, tables, headers and attachments, which is why a quick read misses it.
| Document | Where the SSN usually sits |
|---|---|
| W-2 and 1099 copies | the employee or recipient box |
| W-9 | Part I, taxpayer identification number |
| Client intake form | the identity block at the top |
| Payroll export | a column of its own, often without dashes |
| Loan or lease application | the applicant section |
| Benefits or claim file | the claimant details and the subject line |
Our list, from the forms that most often end up pasted into a chatbot.
XXX-XX-1234: the IRS mask, and why a chatbot needs more
The truncation rule is precise about where it applies. A truncated number may be used on statements or other documents that the internal revenue laws require to be furnished to another person. It may not be used on returns filed with the IRS or the SSA, and a person may not truncate their own number on a document they furnish, which is why a W-9 still carries the full SSN.
Federal courts have a rule of the same kind. Federal Rule of Civil Procedure 5.2 lets a filing include only the last four digits of a Social Security number or taxpayer identification number. Both rules leave four digits, enough for the reader of a W-2 or a docket to tell whose record it is. What else a court filing trims, from birth dates to minors’ names, is in our list of personal information to remove.
| Mask | Format | Written for |
|---|---|---|
| IRS truncated TIN | XXX-XX-9999 | payee statements such as a W-2 copy |
| Rule 5.2 | last four digits | federal court filings |
| A label | [SSN_1] | an AI prompt |
26 CFR 301.6109-4 and Federal Rule of Civil Procedure 5.2, with our label for the third row.
Four digits are still a lookup key
A chatbot does not need to confirm anything, and four digits next to a name and a birth date are much of what a bank’s phone verification asks for. NIST’s guide to protecting PII, SP 800-122, puts it plainly in a footnote: partial identifiers, such as the first or last few digits of an SSN, are often considered PII, because they are still nearly unique and linkable to one person.
New York’s statute goes the same way. Section 399-ddd of the General Business Law defines the protected number to include “any number derived from such number”. The safe version for an AI prompt is the one with no digits at all, and in our check even an SSN already truncated, written SSN: XXX-XX-9999, or a line that read “SSN ending in 9999”, came out of Nonimo as a label.
The ITIN looks like an SSN, and gets the same treatment
The truncation rule covers more than SSNs. It names the ITIN, the adoption taxpayer identification number and the EIN as well. The IRS describes the ITIN as a 9 digit number it issues to people who need a taxpayer identification number but are not eligible for an SSN.
On a form, an ITIN is easy to take for an SSN, and in a prompt it deserves the same care. In our check, an ITIN written with its label came out as [ITIN_1], a label of its own, so the AI can tell the two kinds of number apart without seeing either.
What the Social Security Administration says about sharing your number
The SSA’s booklet Your Social Security Number and Card, in its July 2026 edition, gives advice that fits on one line: treat your SSN as confidential information and avoid giving it out unnecessarily. It adds that giving your number is voluntary even when you are asked for it directly.
It then suggests four questions to ask whenever someone wants the number, and they work just as well when the someone is a chatbot.
For a question about a form, a deadline or a tax rule, it is not.
A prompt can end up in a history, a log or a shared workspace.
The other two are what happens if I refuse, and what law requires me to give my number. For a chatbot, the answers are nothing, and none. Nothing about the quality of an answer on filing status, withholding or a benefit claim depends on the nine digits. What each provider then keeps is covered in what OpenAI does with your chats.
The same advice reads differently from the other side of the desk. A client who emails an SSN to a preparer or a paralegal is sharing it for one reason, the return or the case. Pasting that email into a chatbot gives the number a second reader the client never asked for, and the label is how the office keeps the first purpose and drops the second.
If an SSN has already gone into a chatbot
It happens, usually because a whole W-2 or intake form went in when one figure was needed. Delete the conversation, check whether the account keeps chats for training or review, and if the number belonged to a client, tell them. Deleting is more than one button, because a deleted ChatGPT chat can leave a saved memory and an uploaded file behind.
Whether that counts as a reportable breach under state law is its own question, worked through in our guide on client data and chatbots.
The two numbers in this guide, and how far a printed SSN travels
The SSA keeps a page of its own on misused numbers, and both samples here come from it. In 1938 a wallet maker in Lockport, New York, put a sample card in each wallet to show how a Social Security card would fit. The card carried the real number of the company treasurer’s secretary: 078-05-1120.
The wallets were sold at Woolworth and other department stores all over the country, and buyers adopted the number as their own, even though the card was half size, printed in red and marked specimen. At the peak, in 1943, 5,755 people were using it. The SSA voided the number and gave the secretary a new one, yet over 40,000 people reported it as their SSN in all, and 12 were still using it in 1977.
The second number came from the government itself. In 1940 the Social Security Board published a pamphlet with a sample card on the cover, using the invented number 219-09-9999. In 1962 a woman came to the Provo, Utah, office insisting it was hers, and produced her copy of the pamphlet to prove it.
What a printed number teaches about a pasted one
Both stories make the same point. A number that has been printed once does not stay where it was put: it gets copied, kept and reused for decades by people who never meant any harm. A prompt is a printing of its own, and once an SSN is in a conversation history, an export or a shared workspace, it is as hard to recall as a card in a wallet.
That is the practical case for the label. It costs nothing in the quality of the answer, and the number that never left the computer never needs recalling. If you use Copilot inside Microsoft 365, what Copilot does with your prompts sets out where they end up.
No federal data regulator: who protects an SSN in the United States
The United States has no single data protection regulator. For most businesses the federal backstop is the FTC, and its guide Protecting Personal Information is direct about SSNs: use them only for required and lawful purposes, like reporting employee taxes, and do not use them unnecessarily.
The same guide cautions employees against transmitting SSNs, passwords and account information by email, because unencrypted email is not a secure way to send information. A chatbot prompt is not email, but the advice travels well: the number goes out only when the task requires it, and an AI question almost never does.
State laws that protect the number itself
Most of the rules that name the SSN live in state law. California’s Civil Code section 1798.85 says a person or entity may not publicly post or display an individual’s SSN, print it on a card needed to access products or services, or require an individual to transmit it over the internet unless the connection is secure or the number is encrypted.
New York’s General Business Law section 399-ddd has the same internet rule in almost the same words. Neither statute mentions AI, and neither needs to. They describe a number that the law expects to travel as little as possible, which is exactly what a label achieves.
| State | Statute | One rule that applies before an upload |
|---|---|---|
| California | Civil Code 1798.85 | no requiring transmission over the internet unless secure or encrypted |
| California | Civil Code 1798.82 | a name plus an unencrypted SSN is personal information for breach notice |
| New York | General Business Law 399-ddd | the same internet rule, and any number derived from the SSN counts |
California Legislative Information and the New York State Senate, checked October 1, 2026.
Breach laws start with a name and an SSN
State breach notification laws are where the SSN carries the most weight. California’s section 1798.82 defines personal information as a first name or initial and last name combined with, among other things, a Social Security number, when either is not encrypted. A business must notify affected residents within 30 calendar days of discovering a breach, with delays allowed for the needs of law enforcement or to determine the scope of the breach.
The definition turns on encryption: the combination counts when either the name or the number is not encrypted. A label goes one step further than encryption, because there is no key at the provider’s end and nothing to decrypt.
A name next to [SSN_1] is not that combination. A name next to 219-09-9999 is. That is the whole difference between a prompt that is a privacy question and a prompt that is a notification question, and our guide to PII, PHI and sensitive personal information sets out the categories state laws build on.
CPA firms and tax preparers: the Safeguards Rule
A tax practice has an SSN on almost every file, and federal rules treat it accordingly. The FTC’s Safeguards Rule, at 16 CFR 314.2, gives an example that removes any doubt: an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution.
That brings the Rule’s notification duty with it. Under section 314.4(j), a notification event involving the information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. A notification event means the acquisition of unencrypted customer information without the person’s authorization.
On top of that sits section 7216 of the Internal Revenue Code on the use and disclosure of tax return information, which our engagement letter guide covers with model wording. The common thread is simple: the SSN is the field every one of these rules is built around, and it is also the field an AI question needs least. Our page for CPA firms shows the step on 1040 prep notes.
Law firms, clinics, local government and insurance: where the SSN turns up
Every sector meets the SSN in a different document, and each has its own page on what else comes out with it.
Law firms
Intake notes, settlement statements and family law files carry SSNs for clients, spouses and children. Rule 5.2 governs what reaches a federal docket, and whether redacting before AI helps or hurts privilege is answered in does redacting protect privilege. Our page for law firms shows the step on an intake note.
Clinics and practices
HIPAA’s safe harbor list names Social Security numbers among its eighteen identifiers, at letter (G), and older intake forms and billing records still carry them. The full list, read as a checklist, is in our HIPAA guide, and the healthcare page shows a referral letter before and after.
Local government and insurance
City and county files hold SSNs in benefits records and payroll, alongside public records duties of their own, covered in AI in local government. Insurance agents and brokers see them on applications and claim files, and the page for insurance brokers walks through a loss notice.
An intake note, before and after
Here is the kind of note that gets pasted into a chatbot with a quick question at the end. The two SSNs are the SSA’s own historical samples, the phone number sits in the 555 range set aside for fiction, and the email uses a reserved domain.
BEFORE Client: Ms. Marisol Tennerby, date of birth 03/14/1981
SSN: 219-09-9999. Spouse's Social Security number 078-05-1120.
Cell (614) 555-0142, email m.tennerby@example.com
Can she still file jointly for 2025 if they separated in November?
AFTER Client: [PERSON_1], date of birth [BIRTH_DATE_1]
SSN: [SSN_1]. Spouse's Social Security number [SSN_2].
Cell [PHONE_1], email [EMAIL_1]
Can she still file jointly for 2025 if they separated in November?That is Nonimo’s output on October 1, 2026, exactly as it came. The two SSNs got two labels, so the AI can still keep the spouses apart. The name, the birth date, the cell number and the email went too, and the question itself, the tax year and the month of separation, stayed whole.
What happens when the answer comes back
The chatbot answers in terms of [PERSON_1] and the two labels, because that is all it has. When the answer comes back into the Nonimo app, the real values are put back on your screen, so the reply reads as if it had been written about the actual client. The model never saw the digits, and nobody had to retype them.
What to keep so the answer is still right
Taking out the SSN should never take out the facts the question turns on. In a tax question those are the tax year, the filing status, the state, the dates and the amounts. In a benefits question, the program and the dates. None of them is an identifier on its own, and removing them only produces a worse answer.
The tax year, the filing status, the state, and the dates and amounts the question turns on.
An exact birth date to an age, a small town to the state, a rare job title to the industry.
The things to round or generalize are the ones that single a person out in combination: an exact birth date where an age would do, a small town where the state would do, an unusual job title where the industry would do. The SSN goes completely; the rest is judgment.
This is pseudonymization rather than anonymization, and that is what makes it useful: you keep the key, so the answer can be matched to the right file. Our comparison of deidentified and anonymized explains the difference in American terms.
Redacting an SSN in Word, Excel, PDF and PowerPoint
Each format hides the number somewhere different, and each has its own guide in this series.
Black highlights, hidden text, headers, comments, speaker notes and hidden slides.
An SSN column on a hidden sheet, an export without dashes, digits under a drawn box.
Word and PowerPoint
In the test file for our Word guide, an SSN set in black on a black highlight looked gone on the page and came straight back out of the file. Check headers, footers, comments and hidden text, then the file’s properties. In a slide deck, check the hidden slides and the notes: in the test deck for the PowerPoint guide, the SSN sat on a hidden backup slide.
Excel and CSV
In a spreadsheet, the cleanest move is to delete the SSN column from the copy you send. If a task genuinely needs the last four digits, the Excel guide shows how to build them with RIGHT and paste them as values. For a plain export, the CSV guide covers the same step, with one code per person.
PDF and scans
For a PDF, redact the text rather than drawing over it, or copy out the text and paste only what the question needs. A scanned card or form is a picture, and a picture of an SSN is still an SSN: crop it or leave it out of the upload. An uploaded photo can also stay with the provider longer than the chat, which the guide to whether ChatGPT stores images explains.
Before you upload: six checks for SSNs
Run these on the copy you will actually send, in this order, so the last read is of the cleanest text.
- Ask what the question needs. Most questions about a form, a deadline or a rule need no number at all.
- Search every shape. With dashes, without them, and the words SSN, Social Security, SS# and TIN.
- Look where reading misses. Headers, footers, comments, hidden sheets and slides, quoted email threads.
- Replace, do not black out. One label per number, the same label every time the same person appears.
- Catch the neighbors. The ITIN, the birth date, the account number and the address that sit beside an SSN on most forms.
- Read it as an insider would. If someone who knows the client could still tell who it is, generalize until they could not.
The FTC’s guide starts its five principles with “take stock”: know what personal information you have in your files. This list is that principle applied to one document, on the way out of the office, and it fits on one page of a written AI policy.
Redacting SSNs every day: the app on your own computer
For one message, the box on our guide to personal information does the job in seconds. For an office that handles SSNs all day, the Nonimo app for Mac and Windows does the same on the computer itself: select the text, press one key, and the SSN, the name and the birth date become labels before the text goes anywhere.
Nonimo is software that replaces SSNs, names and account numbers with labels before the text reaches ChatGPT, Claude or Copilot. It shows every change on screen so you can see what was replaced and why, and the map back to the real values stays encrypted on your computer, as our security page sets out. It works the same way with Claude and Gemini.
What it recognizes on American paperwork
Beyond the SSN, it covers the identifiers that travel with it: names, dates of birth, street addresses, phone numbers and email addresses, card numbers, account numbers and the ITIN. An SSN with its label, SSN or Social Security number, becomes [SSN_1] with dashes or without, in a form field or mid sentence.
The result is a prompt that keeps everything the question needs and nothing a breach statute counts.
Sources
Each source below was checked on October 1, 2026. Pages on ssa.gov refuse automated requests, so their text was read from the Internet Archive’s copies of the same pages, dated below; the New York statute was read on nysenate.gov itself.
- 26 CFR 301.6109-4, IRS truncated taxpayer identification numbers. The definition of a TTIN, the format XXX-XX-1234, where it may be used, and that it may not be used on returns filed with the IRS or the SSA or on one’s own W-9. law.cornell.edu
- Federal Rules of Civil Procedure, Rule 5.2. Filings may include only the last four digits of a Social Security number or taxpayer identification number. law.cornell.edu
- Social Security Administration, Social Security Number Randomization (archived September 14, 2026). The area, group and serial structure, randomization from June 25, 2011, the area numbers excluded from assignment, and the approximately 420 million numbers available. ssa.gov
- Social Security Administration, Your Social Security Number and Card, Publication No. 05-10002 (July 2026, archived August 28, 2026). Treat the SSN as confidential and avoid giving it out unnecessarily; giving it is voluntary; the four questions to ask. ssa.gov
- Social Security Administration, Social Security History, Social Security Cards Issued by Woolworth (archived August 31, 2026). The 1938 wallet card with 078-05-1120, the 5,755 users in 1943, over 40,000 in all, 12 in 1977; the 1940 pamphlet with 219-09-9999 and the 1962 visit in Provo. ssa.gov
- IRS, Individual Taxpayer Identification Number (ITIN). A 9 digit number for people who need a taxpayer identification number and are not eligible for an SSN. irs.gov
- NIST, SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (April 2010). Footnote 21: partial SSN digits are often considered PII. nvlpubs.nist.gov
- FTC, Protecting Personal Information: A Guide for Business. The five principles starting with take stock; SSNs only for required and lawful purposes, not used unnecessarily, and not sent by unencrypted email. ftc.gov
- FTC Safeguards Rule, 16 CFR 314.2 and 314.4(j). An accountant or tax preparation service as a financial institution; the definition of a notification event; notice to the FTC within 30 days for events involving at least 500 consumers. law.cornell.edu and section 314.4
- California Civil Code section 1798.85. The limits on posting, printing and requiring internet transmission of an SSN. leginfo.legislature.ca.gov
- California Civil Code section 1798.82. Personal information as a name with an unencrypted SSN, and notice within 30 calendar days. leginfo.legislature.ca.gov
- New York General Business Law section 399-ddd. The definition including any number derived from the SSN, and the internet transmission rule. nysenate.gov
- HIPAA Privacy Rule, 45 CFR 164.514(b)(2)(i). The safe harbor list of eighteen identifiers, with Social Security numbers at letter (G). law.cornell.edu
- Internal Revenue Code section 7216. The limits on a tax return preparer’s disclosure and use of information furnished for preparing a return. law.cornell.edu
- Our check. Every line in this guide that shows Nonimo’s output was run through its engine on October 1, 2026, block by block and line by line. The two SSNs are the SSA’s historical samples above, the phone number is in the 555-0100 to 555-0199 range reserved for fiction, and the email uses the reserved example.com domain.
Common questions
How do I redact a Social Security number?
Replace all nine digits with a label such as [SSN_1], everywhere the number appears: with dashes, without them, in tables and in quoted emails. A black box drawn over a PDF is not enough, because the digits usually stay in the text layer and come back with copy and paste.
What is the official way to mask an SSN?
The IRS calls it a truncated taxpayer identification number: the first five digits are replaced with Xs or asterisks, as in XXX-XX-1234. Federal courts use a similar rule, Rule 5.2, which keeps only the last four digits in a filing.
Is it safe to put my Social Security number into ChatGPT?
Leave it out. The Social Security Administration tells people to treat the number as confidential and to avoid giving it out unnecessarily, and a question to a chatbot about taxes, benefits or a form almost never needs the digits to get a useful answer.
Are the last four digits of an SSN safe to share?
Not as a rule. A footnote in NIST SP 800-122 says partial SSN digits are often considered PII, since they stay nearly unique to one person, and four digits beside a name and a birth date narrow the field fast. For an AI prompt, take out all nine.
Is it legal to ask someone to send their SSN over the internet?
In California and New York, a business may not require a person to transmit their SSN over the internet unless the connection is secure or the number is encrypted. Both rules sit in each state's own SSN protection statute, Civil Code 1798.85 and General Business Law 399-ddd.
Do tax preparers have extra rules for client data?
Yes. The FTC's Safeguards Rule treats an accountant or other tax preparation service as a financial institution. When unencrypted information of at least 500 consumers is acquired without authorization, the Rule requires notice to the FTC no later than 30 days after discovery.
What are 078-05-1120 and 219-09-9999?
Two numbers from Social Security's own history. 078-05-1120 came printed in wallets sold at Woolworth from 1938, and over 40,000 people reported it as theirs. 219-09-9999 appeared on a sample card in a 1940 Social Security Board pamphlet.
Which SSN formats does Nonimo cover?
In our check on October 1, 2026, an SSN labeled SSN or Social Security number became [SSN_1] with dashes or without, in a form field or mid sentence. Two SSNs get [SSN_1] and [SSN_2], and even a truncated SSN: XXX-XX-9999 comes out as a label.