Many teams search for a free PII scanner before they buy one. Many free tools exist, but most of them do a different job from the one you need. Some tools find PII in files. Some tools are libraries that you put into your own code. Other tools scan source code, not data.
This guide puts each tool into the correct group. For each tool, it gives the licence, the date of the last release, and what the tool can and cannot read. We checked each fact against the project's own repository or documentation in November 2026.
Full disclosure: we make PII Crawler, a paid scanner. It is not on the list below because it is not free. The last section tells you when a free tool is sufficient and when it is not.
Three types of free tool
Before you select a tool, identify your job. Free tools do one of three jobs.
- Scan stored files or data stores. You point the tool at a folder, a share, a bucket, or a database. The tool gives you a list of the locations that contain PII. This is the usual job for an audit or a breach investigation.
- Find PII in text that your software processes. You call a library from your code. The library finds PII in a string and can redact it. This is the usual job before you send text to a language model or write it to a log.
- Find PII in source code. The tool reads your application code. It shows where the code collects or sends personal data. It does not look at the data itself.
Most searches for an "open source PII scanner" are for job 1. Most open-source tools do job 2. Make sure that the tool you select does your job.
Quick comparison
| Tool | Job | What it reads | Licence | Last release | Status |
|---|---|---|---|---|---|
| pdscan | Scan data stores | Text files, archives, 10 database and storage types | MIT | v0.2.0, Aug 2026 | Active |
| hawk-eye | Scan data stores | Files with OCR, cloud storage, databases, Slack, Google Drive | LGPL-2.1 with Commons Clause (not OSI) | v-0.3.38, Oct 2026 | Active |
| ClamAV | Scan files | Text content: credit card numbers and US SSNs only | GPL-2.0 | 1.5.4, Aug 2026 | Active |
| Octopii | Scan files | Images and documents with OCR, on Linux and macOS | MIT | v2.2, Nov 2023 | Dormant |
| CUSpider | Scan files | Files on Windows desktops | GPL-2.0 | Source dated 2011 | Old |
| Presidio | Library | Text, images, DICOM images, tables | MIT | 2.2.366, Oct 2026 | Active |
| DataFog | Library | Text, with optional OCR | MIT | 4.9.0, Sep 2026 | Active |
| DataProfiler | Library | CSV, JSON, Parquet, Avro, text | Apache-2.0 | 0.14.0, Sep 2026 | Active |
| scrubadub | Library | Text | Apache-2.0 | 2.0.1, Sep 2023 | Inactive |
| Bearer CLI | Source code | Go, Java, JavaScript, TypeScript, PHP, Python, Ruby | Elastic License 2.0 (not OSI) | v2.1.3, Oct 2026 | Active |
| Privado | Source code | Java and Python | LGPL-3.0 | v1.3.92, Oct 2026 | Active |
"Not OSI" means that the source is available, but the licence is not an open-source licence approved by the Open Source Initiative. Read these licences before you use the tool in a commercial service.
Tools that scan files and data stores
pdscan
pdscan is a command-line tool written in Go. It scans files and folders, Amazon S3, Elasticsearch, OpenSearch, MongoDB, Redis, and five SQL databases: Postgres, MySQL, MariaDB, SQL Server, and SQLite. You can install it as a single binary, with Homebrew, or with Docker.
pdscan reads files as text and opens zip and gzip archives. It does not extract text from PDF or Office files: the PDF code in its source is disabled. It uses regular expressions, column names, and a list of common US last names. It also samples data and does not read every row. Its credit card rule is a pattern only, with no Luhn check.
Use pdscan for a fast first look at a database or a bucket. Do not use it to audit a file share that contains mostly PDF and Word documents.
hawk-eye
hawk-eye is a Python command-line tool. It scans local file systems, S3, Google Cloud Storage, Google Drive, Slack, Firebase, and several databases. Its README says that it reads docx, xlsx, pptx, PDF, images, and archives, and that it uses OCR on images.
Read the licence carefully. The repository licence is LGPL-2.1 with the Commons Clause added. The Commons Clause removes the right to sell the software, or to sell a product made from it, without permission from the author. Thus hawk-eye is source-available, not open source. The PyPI package metadata says "Apache 2.0", but the repository licence is the one that applies.
ClamAV structured data detection
ClamAV is the open-source antivirus engine from Cisco Talos. Many administrators do not know that it also has a data loss prevention module. The clamscan --detect-structured option finds credit card numbers and US Social Security numbers in documents and text files. The clamd daemon has the same function with the StructuredDataDetection setting.
The module checks card numbers with the Luhn algorithm and the card issuer prefix. It reports a file only when the file contains a minimum number of matches. The default minimum is three, and you can change it with --structured-cc-count and --structured-ssn-count. A match shows as a detection named Heuristics.Structured.CreditCardNumber or Heuristics.Structured.SSN.
The module has three important limits. It examines only content that ClamAV identifies as ASCII text. It finds only two data types. It does not tell you where in the file the match is. ClamAV is a good tool if you already operate it and you need only card numbers and SSNs.
Octopii
Octopii is a Python tool from RedHunt Labs. It scans images (JPG and PNG) and documents such as PDF, DOC, and TXT. It can read a local path, an S3 URL, or an open web directory. It converts PDF pages to images and uses Tesseract OCR to read them. Then it uses regular expressions and keyword rules to find IDs, email addresses, and phone numbers.
GitHub shows the licence as "NOASSERTION", but the LICENSE file contains the standard MIT text. The README says that Octopii supports UNIX-like file systems, so it does not support Windows. The README also says that the tool is "intended for research and educational purposes only". The last release is from November 2023.
CUSpider
CUSpider is a free Windows scanner from Columbia University. It is a changed version of Spider, an older open-source PII scanner from Cornell University, and it uses the GNU GPL v2 licence. It finds Social Security numbers and other PII on desktops and laptops.
The software is old. The source archive is dated 2011, and the page says that only v1.3.1 is compatible with Windows 7. The page says that Mac and Linux versions are not available. Columbia supports it only on computers that its own IT team manages. It is sufficient for a one-time check of one Windows computer.
Tools that are no longer available or maintained
Many old guides recommend these tools. Do not plan to use them.
- SENF (Sensitive Number Finder), from the University of Texas at Austin. The product page is still online, but its GitHub download link and its commercial support link both return "404 Not Found". The licence was Creative Commons BY-NC-SA, which prohibits commercial use. Thus it was never open source.
- OpenDLP. The last release was 0.5.1, in August 2012.
- PIICatcher, a database scanner. The owner archived the repository in January 2026, and the last release was in July 2023.
- PANhunt, a credit card number scanner from Dionach. It is open source (BSD-3-Clause), but the last change was in April 2023. We describe it in our guide to cardholder data discovery.
Libraries for your own code
These tools do not scan a folder for you. You write a program that gives text to the library, and the library returns the PII that it finds. They are good for pipelines and applications. They are not a quick way to audit a file server.
Presidio
Presidio is the best-known open-source PII library. It finds and anonymizes PII in text, in images, in DICOM medical images, and in structured data. It uses named entity recognition (NER) with spaCy by default, and also regular expressions, rules, checksums, and context words. It uses the MIT licence, and the last release was 2.2.366 in October 2026.
Microsoft started Presidio, but in 2026 the project moved to the Data Privacy Stack organization on GitHub. The project says that it is now "an independent, community-governed open source project". The old microsoft/presidio address redirects to the new address. Many older guides still call it "Microsoft Presidio".
Presidio has no file crawler in its core packages. A separate presidio-cli package can walk a folder, but it reads each file as plain text, and its PyPI release has not changed since 2022. The image redactor uses Tesseract for OCR. The README also says that there is "no guarantee that Presidio will find all sensitive information." The project gives no official support.
DataFog
DataFog is a Python library with the MIT licence. Its core uses regular expressions. You can add spaCy or GLiNER models for names and other entities, and add local OCR for images. The project describes itself as an "offline PII firewall" for AI agents and LLM applications. It includes a guardrail for the LiteLLM gateway. It is a good selection if you must remove PII from prompts before they go to a model.
DataProfiler
DataProfiler is a Python library from Capital One with the Apache-2.0 licence. It loads a CSV, JSON, Parquet, Avro, or text file and makes a profile of the data. The profile includes the schema, statistics, and sensitive entities such as names, SSNs, credit card numbers, and addresses. A pre-trained deep learning model finds the entities. Use it to examine datasets in a data pipeline. It does not read PDF or Office files.
scrubadub
scrubadub is a Python library that removes PII from free text. It finds names, email addresses, phone numbers, credit card numbers, and some national IDs. It uses the Apache-2.0 licence. The last release was 2.0.1 in September 2023, so do not select it for new work.
NER models
Some projects publish open models that find PII entities, for example the GLiNER PII models with the Apache-2.0 licence. A model is not a scanner. Presidio and DataFog can use these models as one part of their detection.
Tools that scan source code
These tools are useful for privacy reviews of an application. They do not find PII in stored files.
Bearer CLI
Bearer CLI is a static analysis tool. It finds security problems and flows of sensitive data, such as PII and PHI, in source code. The free version supports Go, Java, JavaScript, TypeScript, PHP, Python, and Ruby. Cycode acquired Bearer in March 2024. The licence is the Elastic License 2.0, which is source-available but not open source.
Privado
Privado is a static analysis tool with the LGPL-3.0 licence. It finds where code collects, stores, and shares personal data, and it knows more than 110 types of personal data. It is generally available for Java and Python, and it needs Docker. The scan runs locally. After the scan, it asks for permission to send the results file, but not your code, to Privado Cloud.
Secret scanners are not PII scanners
Gitleaks and TruffleHog are good open-source tools. They find passwords, API keys, and other credentials. They do not find Social Security numbers or patient records. Use them for secrets and a different tool for PII.
How to select a free tool
Ask these questions in this sequence.
- Is the data in files, in a database, or in your application? For a database or a bucket, start with pdscan. For text in your application, start with Presidio or DataFog. For source code, use Bearer CLI or Privado.
- Which file formats do you have? Many free file scanners read only plain text. If most of your files are PDF, Word, Excel, or scanned images, you need text extraction and OCR. Of the free file scanners above, only hawk-eye and Octopii claim OCR, and both have licence or platform limits.
- Which data types do you need? ClamAV finds only card numbers and US SSNs. pdscan is designed for US data. If you need names, national IDs from other countries, or health data, you need a tool with more detectors.
- Can the licence and the support level satisfy your organization? Several tools here are not open source, and none of them gives support with a service level. If an auditor will see the results, ask who will repair the tool when it fails.
When a free tool is not sufficient
Free tools are a good start. They are frequently sufficient for one computer, one database, or one pipeline. They are less satisfactory for a file share with many years of Office documents, PDFs, scanned forms, and mail archives. In that situation you must usually add text extraction, OCR, reports, and a method to review false positives.
PII Crawler is our product for that job. It runs on your own computer, on macOS, Windows, or Linux, and it sends no file content to a cloud service. It reads Office documents, PDFs, email archives, and images with local OCR. It costs $497 one time, and it has a 7-day trial. For a comparison with commercial tools, read our comparison of PII scanning and data discovery tools.
Frequently asked questions
Is there a free PII scanner for Windows?
Yes, but the selection is small. CUSpider is a free Windows scanner, but it is old. pdscan has a Windows binary, but it reads only plain text and archives in files. ClamAV runs on Windows and can find card numbers and US SSNs in text files.
Is Presidio a file scanner?
No. Presidio is a library that finds PII in text and images that your code gives to it. Its core packages do not walk folders. A separate presidio-cli package can scan a folder of plain text files.
Which free tool finds PII in scanned PDFs and images?
Octopii and hawk-eye use OCR. Octopii does not support Windows, and its last release was in 2023. The hawk-eye licence does not let you sell it, or a product made from it, without permission. With Presidio, you can use the image redactor, which uses Tesseract OCR, but you must write the code that sends each file to it.
Can a free tool scan an SMB file share?
Most file scanners in this list read a local path. On Linux or macOS, you can mount the share and then scan the mount point. Scans over the network are slower than local scans, and the tool must have read permission on every folder.