Prepare each column
Preserve, mask or exclude columns. Configure normalization, output headers and composite columns before generating the CSV.
Open source · Windows · Local-first
Data Mask Studio DMS
Local, open-source data preparation and masking for Windows.
Prepare useful datasets without sending sensitive content away. Keep analytical correlations and choose what to preserve, mask or exclude.
- Local processing
- No telemetry
- Controlled restoration
What is DMS?
Practical protection for sensitive datasets
Data Mask Studio is a local-first Windows desktop application for data preparation and anonymization. Deterministic data masking keeps repeated values correlated during analysis, with controlled restoration of CSV data and codes in local HTML.
Restoration is controlled through recovery mappings, not through an individually reversible token. Use the local vault or a selective encrypted package paired with its matching CSV.
Main features
Focused tools for local data workflows
Prepare, mask, restore and verify datasets without sending their contents to an external service.
Individual and batch workflows
Process one CSV or reuse saved profiles across a batch. Deterministic masking preserves correlations for repeated values.
Selective transfer packages
DMS 1.3.0 supports password-protected .dmspackage files containing only the restoration mappings for their linked CSV.
Controlled restoration
Restore selected CSV columns or known codes in local HTML. Package-based restoration covers individual CSVs.
Full environment backups
Password-protected .dmsbackup files carry the vault, keys and saved profiles for environment recovery.
Integrity and maintenance
Inspect the vault, run integrity checks and diagnostics, and manage temporary files and compaction locally.
Three different recovery needs
Your vault. A selected transfer. A full backup.
Choose the recovery source deliberately. These files serve different purposes and are not interchangeable.
Local restoration
Encrypted vault
Restore using the corresponding local vault and its original Windows DPAPI-protected keys. CSV and HTML workflows stay local.
Selective transfer · DMS 1.3.0
.dmspackage
The recipient needs the unchanged matching masked CSV, its package, the password and a DMS version supporting the package format. No sender vault or DPAPI keys are needed.
Individual CSVs only. Missing mappings stop restoration; there is no fallback to the local vault.
Environment recovery
.dmsbackup
Recover the vault, keys and saved profiles using the backup password. This replaces the local environment; it is not selective CSV restoration and does not include CSV or HTML files.
Packages and backups contain sensitive recovery data. Keep their passwords separate. See the compatibility and recovery guide for prerequisites and limits.
Inside the application
From configuration to controlled recovery
DMS 1.3.0 screens in Portuguese, captured with isolated synthetic data. Open any screenshot for readable, full-resolution detail.
Reuse a profile across a batch
Three synthetic CSVs processed successfully, with per-file outcomes and a final summary.
Restore from a matching transfer package
The real package workflow restored 120 synthetic rows. The password field is cleared after processing.
How it works
A controlled path from data to analysis
Sensitive data
Data Mask Studio
Masked dataset
Analysis
Controlled restoration
The same effective value, prefix and cryptographic environment produce consistent identifiers across records and files. Restore through the corresponding local vault or a selective package bound to the exact masked CSV.
Security & privacy
Local controls with explicit cryptographic roles
DMS provides deterministic data masking with controlled restoration through an encrypted local vault. It does not claim that individual tokens are reversible or guarantee irreversible anonymization.
Deterministic identifiers
Tokens derive from keyed cryptographic authentication, incorporating the configured prefix and original value.
Authenticated data protection
Protects original values in the vault. Packages and backups use separate password-derived encryption keys.
Protected local keys
Local keys are protected for the Windows user. Processing stays local, with no telemetry or automatic sensitive-data sync.
No telemetry or automatic file uploads. DMS targets Windows and does not guarantee absolute security. Distributions are not digitally signed yet.
Open source
GNU General Public License v3.0 only
SPDX: GPL-3.0-only. Third-party components remain under their respective licenses.
Author