How nullcipher recognises it
name@domain.tld with a letters-only top-level domain; image names like icon@2x.png are not addresses.
This is the rule text of the “E-mail address” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.
Example (fake)
jane.doe@example.comnullcipher replaces it with [EMAIL_1]. example.com is one of the second-level domains reserved for examples in RFC 2606, so this address reaches nobody.
Why it matters in an AI chat
An e-mail address is a direct identifier. Next to a name, a company or an order in the same log line, it tells anyone reading exactly whom the text is about.
It is also the login name for most accounts, so a known address leaves only the password to guess.
Support tickets, error logs and CRM exports are full of other people's addresses. Pasting them shares their data, not just yours.
If it already leaked
- There is nothing to revoke: an address cannot be rotated like a key. Deleting the conversation removes it from your chat history (the hub page lists how, per assistant).
- Expect better-targeted phishing. A message that quotes details from the pasted text is more convincing, so treat unexpected mail that mentions them with suspicion.
- Make sure accounts that use the address to sign in have a unique password and two-step verification.
- If the addresses were customers' or colleagues', tell whoever handles data questions where you work, and mask before pasting next time.
Sources
- RFC 2606: Reserved Top Level DNS Names (example.com, example.net, example.org) — checked 2026-09-23.
Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.