Paste text in and see exactly what Locke would do to it: what it finds, the token each value becomes, and how sure it is. The text stays on your computer.
Available toAll plans
The Sandbox is the one place in Locke where you see the engine work on demand rather than in passing. It's the right tool for four jobs: checking what a change to your data types or strictness actually does, finding out why something you expected to be caught wasn't, seeing what the tokens look like before you rely on them, and satisfying yourself that any of this works — without sending real data anywhere.
Sandbox
Try Locke with sample text before using it elsewhere
Input
Email John Smith (SSN 123-45-6789) at john@acme.com about the Q3 invoice.
Masked output
Email PER_q30n (SSN SSN_0xrg) at EML_up35 about the Q3 invoice.
What was detected
Action
Type
Token
Confidence
masked
person
PER_q30n
96%
masked
ssn
SSN_0xrg
99%
masked
email
EML_up35
99%
Detection ran in the real privacy engine over the local mesh — the same scanner, the same disclosure policy, and the same masks applied to live traffic. Input never left this device. “Disclosed” means the match was found but your disclosure policy lets that type through in the clear on purpose.
A finished run: every value found, replaced by its token, and listed.
1Input. Type or paste anything. It arrives with a sample sentence that trips several detectors at once.
2Masked output. Exactly what an AI tool would receive. The info icon beside the heading explains the tokens.
3What was detected. One row per value found: what Locke did, the type, the token and the confidence.
Running a test
Type or paste text into Input. It starts with a sample sentence full of made-up personal details, so you can run it straight away. Clear empties the box.
Press Run test. It reads Running… while the engine works.
Read the two results: the masked text in Masked output, and a row per value in What was detected.
Copy masked output puts the masked version on your clipboard. Configure detection rules opens Controls, where you change what Locke looks for. Controls has the same test built in at the bottom of the page — Test your rules › Test with sample text — so you can try a change without leaving it.
Walkthrough
Running the sample through the engine
Step 1 of 3
Sandbox
Try Locke with sample text before using it elsewhere
Input
Email John Smith (SSN 123-45-6789) at john@acme.com about the Q3 invoice.
Masked output
Masked result appears here…
What was detected
Run a test to see the detection breakdown — type · token · confidence
1Open the Sandbox from the sidebar. The Input box already holds a sample sentence full of made-up personal details.
Read all 3 steps as text
Open the Sandbox from the sidebar. The Input box already holds a sample sentence full of made-up personal details.
Press Run test.
Masked output shows what an AI tool would receive: the same sentence, with each value replaced by a token that names its type. The table lists each one with its confidence.
Reading the results
Every value Locke masks becomes a short token — EML_x9k2 for an email, for example. The three letters name the kind of value (PHN a phone number, SSN, CCN a card number), then four characters. The same value always produces the same token, so an AI tool can still tell two people apart and follow the thread, and nothing turns a token back into the value.
The detection table's columns
Column
What it tells you
Action
masked — replaced by the token. disclosed — found, but your settings let that type through in the clear on purpose: you switched the type off in Controls, or the value is on your Never flag list.
Type
The engine's name for the kind of value — person, ssn, email and so on.
Token
The token that stands in for the value in the masked output.
Confidence
How sure the engine is, as a percentage.
The test runs through the same engine, with the same settings and the same masks, as your live traffic. So it reflects your current choices on Controls — and on a Teams member's device, the team's policy.
When it finds nothing
No detections in this input means the engine genuinely recognized nothing sensitive. The usual reasons:
Why a test might find nothing
Reason
What to do
A name, place or organization the engine wasn't sure enough about
Try Strict in Controls › Strictness and Modalities and run it again.
It's an identifier only your organization would recognize
You can't write your own detection rules yet — see Known limitations.
A value you expected to be masked that shows up as disclosed was found — it's your settings letting it through. Check the type on Controls › Sensitive data and your Never flag list.
