🔒 The 5 Things You Should Never Paste Into AI

Most advice about AI and privacy comes in two flavours. There’s “never tell a computer anything”, which leaves you with an assistant that can’t actually assist. And there’s “oh it’s fine, paste the lot in”, which is how people end up with a vague uneasy feeling they can’t quite name. Neither is the answer.

Here’s the thing nobody tells you: you already know where the sensible line is. You’ve been drawing it your whole adult life, with people. This guide just shows you that the same line applies to AI, and gives you one small habit that lets you get proper help with sensitive stuff without handing over the sensitive bits.

(If you read Your First 30 Minutes With Claude AI, this is the guide I promised at the end. The rule deserved more than a sentence.)

The Brilliant Stranger Test

Imagine you’ve just met a consultant. Brilliant, fast, endlessly patient, never judges, genuinely wants to help. You’d happily hand them your overflowing inbox, your weird business problem, the fourth draft of a tricky message to your landlord. You would not hand them your bank card and whisper your PIN. Not because you think they’re a crook… because they don’t need it, and handing it over gains you nothing.

That’s the entire rule. Treat AI like a brilliant stranger: generous with your problems, stingy with your credentials. Everything below is that one test, applied five times.

And a reassurance before we start: this isn’t because AI is secretly sinister. It’s the same basic hygiene you’d use with any website or any app. Once you know the five things that stay in your pocket, you’re free to relax about the other 95% of your life, which is the actual point.

The Keep-Back Five

1. Passwords and PINs

Why it stays in your pocket: there is no task on earth where an AI needs your actual password to help you. None. And once something’s typed into any online service, you’ve lost control of where it lives.

What to do instead: describe the problem, not the credentials. “I’m locked out of my email and the reset link isn’t arriving - walk me through what to try” gets you everything you need. The password itself adds nothing.

The bit everyone misses: Claude will never ask you for a password. So if something that looks like an AI chat ever does ask… you’re not talking to the tool anymore, you’re talking to a scam wearing its outfit. Close the tab.

2. Full bank or card details

Why it stays in your pocket: the long card number, the sort code and account number together, the three digits on the back - that’s the raw material of fraud, and budgeting help doesn’t require any of it.

What to do instead: share the numbers that matter, snip the ones that don’t. “My energy bill jumped from £120 to £180 a month, here are my rough monthly outgoings” is a brilliant prompt. A screenshot of your banking app with the account number showing is not. Totals and categories do all the work; the account details do none of it.

The bit everyone misses: statements. People who’d never type their card number will happily paste a whole bank statement to get it categorised. Great idea, genuinely - just crop or blot the account numbers first. The spending data is the useful bit anyway.

3. Other people’s private information

Why it stays in your pocket: it isn’t yours to share. Your client’s contact details, your colleague’s health situation, the messy details of your friend’s divorce, anything about somebody’s kids - they didn’t agree to be pasted anywhere.

What to do instead: summarise, or use placeholders. “My colleague - call her S - has been off sick and I need to write a sensitive message to the team” works exactly as well as her full name and diagnosis. The advice you get back is just as good. Better, sometimes, because you’ve been forced to describe the actual situation.

The bit everyone misses: this is the rule people break without noticing. Nobody pastes a passport by accident, but forwarding a whole email thread for “help replying to this” is second nature - and that thread has other people’s names, addresses and signatures all through it. Skim before you paste. Ten seconds.

4. Work-confidential material

Why it stays in your pocket: contracts, unreleased numbers, customer lists, anything with an NDA hovering over it - your employer may have rules about where that goes, and “I pasted it into a chatbot” is not a sentence you want to say in a meeting.

What to do instead: recreate the shape without the substance. “I’ve got a spreadsheet with columns for client name, project stage and invoice status - help me design a better layout” needs zero real data. Dummy numbers work as well as real ones for almost everything. And if you’d genuinely benefit from using the real thing, just ask at work what the policy is - more and more places have one, and asking makes you look switched on, not behind.

The bit everyone misses: the honest test isn’t “is this technically allowed”, it’s “would I email this to an outside consultant without checking with anyone first?” If the answer’s no, redact it or ask first. (Your privacy toggle in Settings → Privacy matters here too, but a toggle isn’t permission - the question above still applies.)

5. Identity documents

Why it stays in your pocket: your passport, driving licence and National Insurance number are the ingredients of identity theft. AI can help you with almost any document task without ever seeing the document itself.

What to do instead: type the one fact that’s relevant. “My passport expires in March and I’ve got a trip in May - talk me through renewing it” contains everything useful and nothing risky.

The bit everyone misses: photos count. The “I’ll just snap a picture of the form” habit is lovely for a recipe or a parking sign, but a photo of an official document uploads every number on it, including the ones you’d never dream of typing. If it lives in the drawer with your birth certificate, it doesn’t go in the chat.

The redaction habit

Here’s the habit that makes all five easy: placeholders. Swap the private bits for labels in square brackets, get your answer, fill the real details back in afterwards. Claude handles this beautifully - you just have to tell it what you’re doing.

Nick this one:

I'm about to paste something in with the private details swapped for placeholders like [NAME], [ACCOUNT NUMBER], [ADDRESS] and [COMPANY]. Treat the placeholders as if they were the real details: keep them exactly where they are in anything you write for me, so I can fill the real information back in afterwards. Don't ask me what any placeholder stands for - you don't need to know. If a placeholder genuinely blocks the task, tell me what *kind* of detail you're missing (a date, a rough amount) and I'll give you an approximate version.

Here's the text: [PASTE IT]

And the ten-second check to run before any paste. Save it somewhere you’ll see it:

Nick this one (save it in your notes app):

BEFORE I PASTE - THE TEN-SECOND CHECK
1. Any passwords or PINs in here? Delete them.
2. Any full card, account or sort code numbers? Blot or crop them.
3. Anyone else's name, contact details or private business? Swap for [PLACEHOLDERS].
4. Anything my employer would call confidential? Recreate the shape with dummy details, or ask first.
5. Any photo or scan of an official document? Type the one fact I need instead.
Everything else: paste away and get on with your day.

A worked example

Say your mum’s been overcharged on her phone bill and you’re helping her fight it. The tempting move is to paste the whole bill - her name, address, account number, the lot. The better move takes thirty seconds longer:

“My mum - I’ll call her [MUM] - is on a £14/month SIM-only deal but her last two bills were £31 and £29. The extra charges are labelled ‘out of plan usage’ but she says she hasn’t changed anything. Draft a complaint to the provider asking for an itemised breakdown and a refund, firm but polite, and tell me what her rights are if they refuse.”

Same brilliant answer. Zero of her details anywhere. That’s the whole skill.

The small print

Honesty corner. Redacting your pastes protects you from oversharing - it doesn’t protect you from fake websites, dodgy links or phishing emails, which are a different animal entirely (there’s a guide for that below). And this list isn’t a legal document: if you handle other people’s data professionally - clients, patients, students - your industry’s rules sit on top of mine, not underneath them.

Also, none of this makes AI dangerous to use. It makes it exactly as safe as everything else you do online, which for most of us is “fine, with basic sense”.

If today only has five minutes in it

Adopt the placeholder habit. [NAME], [ACCOUNT], [ADDRESS]. It takes ten seconds, the answers are just as good, and it quietly covers most of the five without you having to memorise anything.

Right - now that you know what never to paste in, learn what absolutely should go in: suspicious messages. Is This Message A Scam? Ask AI First turns Claude into your free fraud-checker. ✨