Harithas Harikaran
EN DE

case study 04 / 05 · desktop tool · version 1.3, delivered October 2026

Anonymizer

Offline tool that removes client identifiers from documents for good, then proves it

A Windows tool that removes client identifiers for good from PDF, Word, PowerPoint and Excel files and then proves it: every saved copy is re-opened and searched again. A person reviews what the tool found before anything is written, and everything runs offline from a copied folder, so confidential documents never leave the PC. I designed, built, tested and released it as a working student at S01; the demo shows version 1.3 with invented documents of a made-up company.

Open the live demo How it works
PythonPySide6PyMuPDFspaCyTesseract OCRlxmlPyInstaller
106automated tests
4file formats: PDF, Word, PowerPoint, Excel
4automatic checks on every output
10detection categories
Role
development, as a working student at S01 Projektmanagement GmbH (design, tests and release)
Made for
non-technical staff, including the supervisor
Platform
Windows 10 and 11, offline, no installation
Delivered
version 1.3 on 20 October 2026: a portable folder (about 200 MB zipped) with a German quick guide
01 / why it exists

Covering a name is not the same as removing it

Client documents have to be anonymized in bulk before they leave the company. A client does not appear only as a name: it hides in spellings and abbreviations, in people, signatures and logos, in running headers and revision tables, and in the metadata of the file.

Covering is not removing. A black box can be taken away again, the text under it can be copied, extracted or read by OCR, and the PDF objects still hold the original. The tool therefore deletes the content itself, so that none of these routes brings it back.

A result also has to be checked, not trusted: every output is re-opened and searched again before it counts as finished. And because the documents are confidential, the whole tool works offline.

Who it is for

Non-technical staff, including the supervisor. That is why it is a guided wizard that runs from a copied folder.

What it costs to run

Nothing to host or install: it runs offline from a copied folder on Windows 10 or 11, without admin rights.

02 / how it works

How a document travels from the wizard to a checked copy

Architecture diagram: Anonymizer The wizard hands the chosen files to the batch pipeline. Format handlers scan and redact a temporary copy, using detection and OCR. The quality check re-opens the saved copy, and the pipeline names it and writes the HTML report. SPACY · REGEX Detection names, contact data PYMUPDF · LXML Format handlers one per file format TESSERACT OCR reads scans, images PYSIDE6 Wizard four guided steps PYTHON Batch pipeline originals untouched PYMUPDF · TESSERACT Quality check re-opens the copy HTML QC report PASS or FAIL per file OFFLINE MANDATORY ON A COPY 4 CHECKS Architecture diagram: Anonymizer The wizard hands the chosen files to the batch pipeline. Format handlers scan and redact a temporary copy, using detection and OCR. The quality check re-opens the saved copy, and the pipeline names it and writes the HTML report. SPACY · REGEX Detection names, contact data PYMUPDF · LXML Format handlers one per file format TESSERACT OCR reads scans, images PYSIDE6 Wizard four guided steps PYTHON Batch pipeline originals untouched PYMUPDF · TESSERACT Quality check re-opens the copy HTML QC report PASS or FAIL per file OFFLINE MANDATORY ON A COPY 4 CHECKS
  1. 1Name the client OFFLINEThe user types in the client's names, or lets the tool detect the companies in the chosen files. Several clients can be handled in one run.
  2. 2Scan every fileEach file is searched for client spellings, personal data (names, e-mail, phone, signature lines), abbreviations, document zones, logos and metadata. Scanned pages and images are read by OCR.
  3. 3Review the findings MANDATORYEverything found is pre-ticked in a mandatory preview. The user unticks, keeps single spots, draws boxes, adds a missed term and ticks any image to remove; signature images are not found automatically.
  4. 4Remove for good ON A COPYOn a copy, text, covered pixels, logos, metadata, comments and hidden parts are deleted, not just covered. In Word, PowerPoint and Excel files every removed character is replaced by a solid block.
  5. 5Check the saved copy 4 CHECKSThe saved file is re-opened and searched four ways: text and internal objects, OCR of every page and image, hidden content, removed images. For Word, PowerPoint and Excel, OCR reads embedded images only.
  6. 6Name it and reportA passing copy gets the suffix _ANON, a failing one _ANON_QC-FAILED. An HTML report lists every file with PASS or FAIL and shows the client terms masked.
03 / data model

The objects behind one run

Data model: Anonymizer One client profile applies to many documents. A document has many findings and many images, and findings and images point to redaction areas. A document has at most one file outcome, which has at most one QC result. Client profile one per run Clients (one or more) Full company names Extra terms Options Document one per file PK File path Pages Findings Images Error Finding a match, with its places Category Text Location Ticked Places Redaction area one per place Page Rectangle Kept readable Image one per distinct picture PK Image ID Kind (image or vector) Pages Likely logo Remove File outcome one per processed file PK Original file Status (PASS/FAIL/ERROR/SKIPPED) Output name Number of redactions QC result one per outcome Passed Four checks Problems

  • Client profile object

    one per run

    • Clients (one or more)
    • Full company names
    • Extra terms
    • Options
    • 1 profile → many documents of a run

  • Document object

    one per file

    • PKFile path
    • Pages
    • Findings
    • Images
    • Error
    • 1 document → many findings
    • 1 document → many images
    • 1 document → at most 1 file outcome

  • Finding object

    a match, with its places

    • Category
    • Text
    • Location
    • Ticked
    • Places
    • 1 finding → many redaction areas

  • Redaction area object

    one per place

    • Page
    • Rectangle
    • Kept readable

  • Image object

    one per distinct picture

    • PKImage ID
    • Kind (image or vector)
    • Pages
    • Likely logo
    • Remove
    • 1 image → one or more redaction areas

  • File outcome object

    one per processed file

    • PKOriginal file
    • Status (PASS/FAIL/ERROR/SKIPPED)
    • Output name
    • Number of redactions
    • 1 file outcome → at most 1 QC result

  • QC result object

    one per outcome

    • Passed
    • Four checks
    • Problems

Simplified: 7 of 15 entities (13 classes in the code plus the redaction area and the HTML report). Left out: search terms (derived from the profile), raw matches, client suggestions, the app state and the report file.

One logo, one entry

A logo that repeats on every page is a single entry, because images are grouped by their content.

Spellings become patterns

Every client spelling becomes a pattern that survives case, spaces, hyphens, line breaks and legal-form suffixes.

Masked in the report

The report masks every term and keeps only its first and last letter.

04 / decisions

Trade-offs that shaped the build

Remove the content, then prove it

The tool deletes text, covered pixels and hidden parts from a copy and writes a whole new file, instead of only drawing black boxes. A separate check then re-opens the saved copy and searches it four ways. The price is time: OCR reads every page at check time.

The tool suggests, a person decides

Offline name recognition is imperfect, so every batch goes through a mandatory preview. Everything found is pre-ticked, and nothing is written before the user presses “Redact”. The price is a person's attention on every batch, and the page view exists for PDF only.

Office files are edited as XML

Word, PowerPoint and Excel files are opened as packages and edited part by part, so format and layout stay as they were. The price is the largest module of the tool, which has to know every place text can hide.

Offline and portable, models inside

The tool is one folder with the language and OCR models inside: no installation and no internet. The price is size and platform: about 460 MB unpacked and Windows only.

05 / my part

What I did

  • Designed the tool from the written brief and decided the trade-offs above.
  • Built the release process: a portable Windows folder, a self-test that must pass before the zip is made, and five releases from v1.0 to v1.3.
  • Tested the quality check on a set of real sample documents and tuned it; the false alarms and over-redaction it exposed were fixed in v1.2.1.
  • Designed the look in the S01 corporate style (colours, fonts, launch screen) and built the clickable demo, which shows a made-up company and invented documents.
06 / result

Version 1.3 delivered on 20 October 2026

Delivered as a portable Windows folder (about 200 MB zipped) with a German quick guide; version 1.3 is the fifth release. The code base has 106 automated tests, and the build stops if its built-in self-test fails.

Open the live demo