Detection reference · Personal data · Updated 2026-11-03

US Social Security numbers

A Social Security number is shaped like many invoice and part numbers, so the rule checks it against the ranges the Social Security Administration never assigns before it flags anything.

At a glance

Reported as	Social Security Number
Category	Personal data
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[SSN]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 194

What it looks like

Three digits, a hyphen, two digits, a hyphen, four digits. Area 000, 666 and 900 to 999, group 00 and serial 0000 are skipped.

Example

You paste

Applicant SSN: 078-05-1120

Redaxa returns

Applicant SSN: [SSN]

Reported as	Social Security Number
Severity	high: direct financial exposure or a strong identifier, such as a card or national number
Replaced with	`[SSN]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

data/applicants.csv: Social Security Number, listed for review (severity high). Potential sensitive data. Context and authorization must be reviewed; this is not a confirmed vulnerability.
Same value in tests/fixtures/applicants.csv: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

SSN 000-12-3456: not flagged. Area 000 is never issued.
SSN 987-65-4321: not flagged. Areas 900 to 999 are never assigned.

Known false positives

Text that is harmless but still flagged today. Listed so you can recognise it, not hidden.

Part number 123-45-6789: flagged as Social Security Number. Any number in the valid ranges with this shape is flagged, whatever the label in front of it says.

What to do

Remove the number. If a real SSN was exposed, the SSA and the US Federal Trade Commission (IdentityTheft.gov) describe the steps for the person it belongs to.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 194. Every output on this page was produced by that code when the page was built.
SSA History: Social Security numbers misused (the Woolworth wallet card)
SSA: Social Security number randomization