How to redact secrets from text
- Paste a log, a config file or a message, or open a file.
- Check the list of what was found, and untick anything you want to keep.
- Copy the redacted text or download it.
Examples
A line from a .env file, DB_PASSWORD=Tr0ub4dor&3, becomes DB_PASSWORD=[REDACTED:password]. The name stays, so whoever reads it still knows which setting it was.
A database link, postgres://shop:S3cretPass@db.example.com:5432/shop, becomes postgres://shop:[REDACTED:url-password]@db.example.com:5432/shop. Only the password between the colon and the @ is masked.
A log line with Authorization: Bearer followed by a long token starting eyJ is found as a JSON Web Token. The whole token is masked, and the time and the rest of the line stay as they were.
Ordinary text is left alone. A sentence such as Never share your password with anyone has nothing to mask, and neither has a git commit ID or a UUID.
About this tool
Before you paste a log into a support ticket or a config file into a chat, take out the keys and passwords. The tool looks for key formats used by AWS, GitHub, Stripe, Google, OpenAI and others, plus tokens, private keys, passwords inside links and values named password, secret, token or key. You see each one with its line number, can keep any you choose, and copy the masked text.
Common questions
Which secrets can it find?
Keys in the formats used by AWS, GitHub, GitLab, Slack, Stripe, Google, OpenAI, Anthropic, npm, PyPI, SendGrid and Hugging Face, JSON Web Tokens, private key blocks, passwords inside links, Authorization headers, and values whose name says password, secret, token or key.
Can it miss something?
Yes. It knows common formats and names. A password written as plain words with no label, or a key in a format it doesn't know, can slip through, so read the result before you share it.
Can I mask email addresses and phone numbers too?
Yes. Tick the options above the boxes. They are off at first, because emails and phone numbers in a log are often fine to share.
What if a real key was already shared?
Revoke it or create a new one with the service that issued it. Masking a copy doesn't stop a key that someone has already seen from working.
Is it free to use?
Yes. There's no sign-up, and you can use it as often as you like.
Is my text uploaded anywhere?
No. This tool runs inside your browser, so what you enter stays on your device.
Do I need to install anything?
No. It works in your browser on a computer or a phone.