rehydra

Detects, replaces, encrypts, and rehydrates back when needed.
Documentation · Issues
npm i rehydra · npm i @rehydra/cli · npm i @rehydra/opencode
The Problem
When you send code, messages, or documents through an LLM, real names, emails, and API keys go with them. Existing anonymizers strip PII permanently but that breaks the conversation. The LLM can't reason about "John" if it never sees "John," and it can't write a file referencing john@acme.com if that address was permanently removed.
You need pseudonyms that the LLM can work with, and that your tools can reverse.
How Rehydra Solves It
1. **Detect** — Regex patterns catch structured PII (emails, phones, UK postcodes, IBANs, credit cards). An on-device NER model (ONNX, no cloud calls) catches soft PII (names, organizations, locations).
2. **Replace** — Each PII value gets a stable placeholder: . The LLM works with these instead of real data.
3. **Persist** — The same entity always gets the same ID, across every message in the session. The LLM maintains relational coherence without ever seeing real PII.
4. **Rehydrate** — When a response needs to become real again (a file write, a bash command, a final answer), Rehydra restores the original values from its encrypted map.
Quick Start
Proxy — protect your AI coding tools
Run a local proxy that anonymizes PII before it reaches the LLM and rehydrates responses. Works with Claude Code, Cursor, and any OpenAI/Anthropic-compatible client.
Names, emails, phone numbers, and secrets are replaced with placeholders in transit. Tool results (file reads, bash output) are anonymized on the way out. Tool call arguments (file writes, bash commands) are rehydrated on the way back. The LLM never sees real PII — but your tools always get real values.
> **Note:** The proxy requires an Anthropic API key. Claude Max/Pro subscriptions use OAuth which api.anthropic.com does not support through proxies.
Browser extension — anonymize ChatGPT and Gemini
Install the Rehydra Chrome extension to protect PII directly in your browser. It replaces names, emails, phone numbers, and secrets with placeholders before your messages reach ChatGPT or Gemini, and rehydrates the responses back to real values in the UI. Detection runs on-device — no data leaves your machine.
OpenCode plugin
Intercepts the conversation between OpenCode and the LLM. Secrets from .env files are replaced with placeholders before they leave your machine and restored before tools execute.
OpenCode's separate session-title request bypasses the plugin hooks and can send the first message without scrubbing. Disable the title agent to prevent that call; see the limitation and configuration.
CLI
For automation and server-side use.
Library — embed PII anonymization in your app
Highly customizable backbone of the implementations above. Supports custom NER models, encryption key providers, session storage providers, tag formats and many more tweaks.
Works in **Node.js**, **Bun**, and **browsers**. No data leaves your machine.
Why Rehydra?
Reversible, not destructive
Most PII libraries mask or redact permanently. Rehydra encrypts the original values with AES-256-GCM and restores them on demand. Anonymize for the LLM, rehydrate for your tools — a full round-trip, not a one-way street.
Session-persistent identity
PERSON_1 stays PERSON_1 across every message in the conversation. When John Smith comes up in message 1, message 5, and message 20, the LLM sees the same placeholder every time. It can track relationships, reference earlier context, and produce coherent multi-turn output — without ever seeing real PII. Sessions persist to SQLite (server), IndexedDB (browser), or in-memory, so identity mappings survive restarts.