How to use
- Paste a log, JSON, config file or HTTP headers into the input, or use Open file or drop a file on the box. The redacted text updates as you type.
- Untick a kind, for example IP addresses, to leave those values as they are.
- Read the redacted output before you share it. Matching is pattern-based and can miss data.
- Use Copy output, or Download to save it as redacted.txt.
What is detected
Email addresses; Thai mobile and landline numbers and international numbers that start with +; 13-digit Thai national IDs, with or without dashes, only when the check digit is valid; JWTs (three base64url parts starting with eyJ); API keys with well-known prefixes such as AKIA, ghp_, github_pat_, glpat-, sk-, sk_live_, xoxb- and AIza; IPv4 and IPv6 addresses.
Secrets: the value after keys such as password, passwd, pwd, secret, token, api_key, access_key, client_secret and private_key, in key=value, key: value and JSON forms; the value after Authorization: Bearer or Basic; and whole PEM private key blocks. The key itself stays visible, so you can still see what was removed.
What is not detected
Names, postal addresses, credit card numbers and other free-form personal data are not detected. Neither are secrets without a recognizable key or prefix, passwords inside URLs, or values split across lines. Numbers that only look like an ID, a phone number or an IP address may be redacted too. Always review the result.
Labels and consistency
Each value is replaced with a label such as [EMAIL_1], [SECRET_2] or [IP_1]. Labels are numbered per kind in order of first appearance, and the same value always gets the same label, so you can still follow which request, user or host is which.
When matches overlap, one replacement is made: the longest match wins. For example, a JWT after Authorization: Bearer becomes one [SECRET_n].
Privacy
Redaction runs entirely in your browser. Your text and files are not uploaded, stored, logged or put in the URL. Copy and Download happen only when you click them.
FAQ
- Is my text uploaded?
- No. Redaction runs in your browser with JavaScript. Your text is not sent to a server and is not stored. Files you open or drop are read in your browser too and never uploaded.
- Does it find everything?
- No. It looks for known patterns, so it can miss data, such as names, addresses or secrets in unusual formats. Review the redacted output before you share it.