Initialising Workbench...
Strip PII, credentials, API keys, and tokens out of logs, code, or LLM prompts before you share them. Detection runs entirely in your browser — nothing is ever uploaded.
Detection is heuristic — it relies on regular expressions to spot common secret and PII shapes locally in your browser. Always do a final manual review for proprietary internal identifiers, unusual token formats, or naming conventions that don't match a standard pattern. Masking is one-way and not a substitute for rotating any secret that was already exposed.
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The Obfuscate & Redact tool scrubs personally identifiable information (PII), credentials, and secret tokens out of any block of text — logs, config files, source code, stack traces, or the prompts you send to AI assistants. It scans for dozens of common patterns and replaces each match with a safe placeholder or a masked value. Everything happens client-side, so your data never leaves the page.
Redact replaces each match with a typed label such as [REDACTED_EMAIL] or [REDACTED_AWS_KEY] — the reader can see what kind of value was removed without seeing it. Obfuscate keeps a few characters at the start and end and masks the middle (for example AKIA****************MPLE), which is useful when you still need to correlate or reference a value across logs without exposing it in full.
.env snippets before attaching them to a bug report, ticket, or public gist.| Category | Examples |
|---|---|
| Personal (PII) | Emails, phone numbers, SSNs, passports, PAN cards, dates of birth |
| Financial | Credit cards, CVVs, IBANs |
| Credentials & keys | PEM private keys, JWTs, bearer tokens, password/secret assignments, database URIs, URLs with embedded credentials |
| Provider secrets | AWS, GitHub, Slack, Google, Stripe, OpenAI/Anthropic, SendGrid, Twilio, and npm tokens |
| Network & IDs | IPv4/IPv6, MAC addresses, UUIDs, Ethereum addresses, Base32 secrets, long hex tokens |
Use the Detection Rules panel to switch individual patterns on or off — the output updates live. Disable any rule that produces false positives for your data, or add company-specific regexes directly in utils/obfuscator.js.
No. Detection, redaction, and masking all run client-side in JavaScript. Your text is never uploaded to a server, logged, or stored, which makes it safe for secrets and regulated data.
Redact replaces each match with a typed placeholder like [REDACTED_EMAIL], so the reader knows what kind of value was removed but not its content. Obfuscate keeps the first and last few characters and masks the middle (e.g. AKIA****************MPLE), which is handy for correlating logs without exposing the full secret.
Emails, phone numbers, SSNs, credit cards, CVVs, IBANs, passport and PAN numbers, IPv4/IPv6 and MAC addresses, UUIDs, JWTs, PEM private keys, database connection strings, URLs with embedded credentials, and provider secrets including AWS, GitHub, Slack, Google, Stripe, OpenAI/Anthropic, SendGrid, Twilio, and npm tokens.
Yes. The Detection Rules panel lets you toggle each pattern on or off, grouped by severity, and the output updates instantly. Turn off rules that cause false positives for your data, or narrow detection to just the categories you care about.
No. Masking and redaction are one-way — the original values are discarded from the output and cannot be recovered from it. Treat this as a scrubbing step, not encryption.
Yes, that's a primary use case. Sanitize prompts before pasting them into ChatGPT/Claude, or clean logs and stack traces before attaching them to bug reports and support tickets. Still review the result manually, since heuristics can miss company-specific identifiers.