How Chinese national IDs and card numbers get detected in a document

China's second-generation national ID is 18 characters, and the last is a check digit. The first 17 digits are each multiplied by fixed weights, summed, taken mod 11, and looked up to derive the expected check character (a digit or X).

The detector computes that check digit and compares it to the last character; only a match flags a suspected ID. This filters out the vast majority of strings that happen to be 18 digits.

Most card numbers satisfy the Luhn check: from the right, double every second digit (subtract 9 if over 9), sum everything, and the total is divisible by 10.

Luhn rejects strings that fail its checksum, but random digits can pass too. Passing establishes a checksum relationship, not a real account.

A plain regex (matching '18 digits') flags order numbers, tracking numbers, and random IDs as national IDs — the false positives are glaring and train people to ignore real alerts.

Checksums can reduce some false positives from pattern matching, but do not eliminate false positives or missed information. Review the surrounding context.

Once the PII scanner flags suspected sensitive fields, you can go back into the document and truly redact those areas (rasterized deletion), not just know that 'something is here.'

The whole chain — detect, validate, redact — runs locally in the browser; numbers are never uploaded.

PDF editing supports basic, unencrypted files up to 50 pages and 25 MiB. Nonempty annotations, internal or external links, forms, attachments, actions and layers are unsupported and stop processing before export. Redaction rebuilds every page as an image, removing searchable and accessible text from all pages. Metadata removal retains supported page content. Output checks reread the actual file, cover only listed items, and do not run OCR. Visually review every output page.