Mask emails, IPs, card numbers, API keys, tokens and passwords in logs before you paste them into a ticket, chat or AI prompt. Redact, pseudonymize consistently, or partially mask.
Paste a log, a config file, a JSON payload or a stack trace and the scanner looks for three families of sensitive data. PII: email addresses, card numbers of 13–19 digits that start with 2–6 and pass the Luhn checksum (with or without spaces or dashes), IBANs that pass the mod-97 check, and, if you opt in, international phone numbers written with a leading +. Secrets: JWTs, AWS access key IDs and secret keys in an aws_secret_access_key= context, GitHub (ghp_, github_pat_…), GitLab, Slack, Stripe, Google, OpenAI and Anthropic keys, PEM/PGP private-key blocks, Authorization: Bearer/Basic values, passwords inside URLs like postgres://user:pass@host, and password=, secret:, token= or "api_key": "…" assignments, where only the value is replaced. Network: IPv4 and IPv6 addresses, plus MAC addresses if you enable them. Checksums and boundary rules help keep random numbers, order IDs, UUIDs, hashes, version strings and timestamps out of the results.
Redact swaps each finding for a typed label such as [EMAIL], [AWS_KEY] or [JWT], which is the safest choice when you only need to show the shape of a problem. Pseudonymize gives every distinct value a numbered placeholder and reuses it everywhere, so the same address becomes EMAIL_1 on every line and the same client stays IP_2. You can still follow one user or one host through a request trace without revealing who they are. Partial mask keeps just enough to recognise a value: the last four digits of a card, the prefix and last four characters of a key (ghp_****Q7r8), the domain of an email, the first two octets of an IPv4 address. Passwords and generic secrets are always fully masked. If two detectors match overlapping text, the earliest and longest match wins, so nothing gets redacted twice.
Everything here is pattern-based. The tool recognises secrets that have a known shape or sit next to a telling key name. A password printed on its own line, a customer name, a home address or an internal hostname has no pattern, and it will pass through unless you add it as a keyword or a regex. False positives also happen: a bare 1.2.3.4 version number with no v, version or build prefix looks exactly like an IP address. Treat the output as a strong first pass, not a guarantee. Skim it before it goes into a public issue, a vendor ticket or an AI chat, and if a real credential ever leaked, rotate it; don't rely on redaction after the fact.
Add project code names, customer names or hostnames as keywords, one per line. They are matched literally, with an ignore-case option. For structured IDs, add a JavaScript regular expression per line, either bare (cust-\d{6}) or with flags (/acct_[a-z0-9]+/i). Patterns are syntax-checked before they run, and all matching happens in a background Web Worker with a time limit. If a pattern backtracks catastrophically, the worker is stopped and replaced after about five seconds and you get a clear message instead of a frozen tab.
No. The text you paste or the file you drop is read by your browser and scanned in a Web Worker inside the same tab. Nothing is sent over the network, and the page works offline once loaded.
No tool can promise that. Detection is pattern-based: it recognises known key formats, validated card numbers and IBANs, common header and assignment shapes, and anything you add as a keyword or regex. Secrets with no recognisable shape, such as a bare password on its own line, can slip through, so always read the output before you share it.
Every distinct value gets a numbered placeholder, and the same value always maps to the same placeholder across the whole input. If [email protected] appears on ten lines, all ten become EMAIL_1, so you can still follow one user or one IP through the log without revealing who or where it is. Emails and IPv6 addresses are compared case-insensitively.
Matching runs in a separate worker with a time limit of about five seconds (a little longer for very large inputs). If a pattern with catastrophic backtracking, such as (a+)+$, runs past the limit, the worker is stopped and replaced, you get a message, and the page stays responsive.
An IPv4 match needs four octets from 0 to 255 that are not part of a longer dotted sequence (1.2.3.4.5 is skipped), not glued to a letter (v2.10.0.1 is skipped) and not preceded by words such as version, release or build. That removes most version strings, but a bare 1.2.3.4 with no such context will still be treated as an IP.
