DOMCloak

DOMCloak is an enterprise-grade data privacy layer that runs entirely inside the browser. It walks the live DOM in real-time, detects 13 categories of sensitive information, and masks them in-place — without moving a single byte to any server. Whether screen-sharing an admin panel, demoing a product, or onboarding a new teammate, DOMCloak keeps private data private. No configuration. No code. Just click Scan, and the page is cloaked. ────────────────────────────────────── WHAT IT MASKS (13 DATA TYPES) ────────────────────────────────────── PII • Email addresses • Phone numbers • Social Security Numbers (SSN) Financial • Currency amounts ($1,234.56 · $50K · €4,500) • Credit card numbers (Visa, MC, Amex, Discover) • Bank routing numbers (ABA 9-digit) • IBAN numbers Network & Infrastructure • IPv4 addresses • MAC addresses Auth & Secrets • JWT tokens • API secrets & tokens (Stripe sk_live_, GitHub ghp_, Slack xoxb-, GitLab glpat-) Cloud Keys • AWS access keys (AKIA/ASIA prefixes) • GCP API keys (AIza prefix) ────────────────────────────────────── KEY FEATURES ────────────────────────────────────── REAL-TIME MASKING Values are replaced in-place inside the DOM. Page layout is completely preserved — only the sensitive content changes. FORMAT-PRESERVING OUTPUT Masked values keep their structure: email domain hints, credit card last-4 digits, IBAN country codes. You always know what type of data it is, even while masked. CLICK-TO-REVEAL (PRO) Need to check a value? Click any masked element to reveal the original for 3 seconds — then it automatically re-cloaks. No permanent exposure. BLUR MODE (PRO) Instead of character replacement, Blur Mode applies a CSS filter to obscure text visually. The data is there; it just can't be read over someone's shoulder. SPOOF MODE (PRO) Replace real values with convincing fake data — ideal for demos, screenshots, and onboarding walkthroughs where you need realistic-looking content. INPUT FIELD MASKING (PRO) Pre-filled sensitive input and textarea fields are blurred on page load. They reveal on focus so you can still interact normally. AUTO-RUN DOMAINS (PRO) Set DOMCloak to activate automatically whenever you navigate to specific domains — your Salesforce, Jira, HR system, or any internal dashboard. CUSTOM REGEX RULES (PRO) Define your own patterns for internal identifiers, ticket numbers, or proprietary data formats. Built-in regex validator catches errors before they affect your page. TEAM CONFIG SYNC (PRO) Export your full settings to a JSON file and share it with your team. Import once — same patterns, same rules, same protection on every machine. LIVE RE-MASKING A MutationObserver watches for dynamically loaded content. New rows, lazy-loaded cards, infinite scroll — all automatically masked as they appear. SHADOW DOM SUPPORT Traverses open Shadow DOM roots so web components and modern SPA frameworks don't hide data from the scanner. ENTERPRISE THEMING Full CSS-variable dark and light themes. Dark is the default; toggle persists across sessions. ────────────────────────────────────── HOW IT WORKS ────────────────────────────────────── 1. Click the DOMCloak icon on any tab 2. The popup scans the live DOM for sensitive patterns 3. Detected types appear as toggles — flip any switch to mask that category 4. Masking applies instantly, no page reload required 5. PRO: Click any masked value to temporarily reveal it ────────────────────────────────────── PRIVACY & SECURITY ────────────────────────────────────── • 100% local processing — no network requests, no external API calls • Zero telemetry, zero analytics • Settings stored only in chrome.storage.local (your device only) • No data ever leaves your browser • Open architecture — content scripts run in the page context only ────────────────────────────────────── PRICING ────────────────────────────────────── CORE (Free): Email, phone, IPv4, currency masking — free forever. PRO: All 13 pattern types + Blur Mode, Spoof Mode, Click-to-Reveal, Input Field Masking, Auto-Run Domains, Custom Rules, Team Config Sync. Payments powered by ExtensionPay — secure, simple, no account required. ────────────────────────────────────── PERMISSIONS USED ────────────────────────────────────── • activeTab: Read the current page's DOM to detect and mask sensitive data • scripting: Inject the content script that performs masking • storage: Save your settings locally on your device • downloads: Export your configuration as a JSON file No host_permissions are used beyond what Chrome grants for activeTab.