[REDACTED] home

Secrets Scrubber

Paste logs, config files or code and get a copy without keys, tokens and passwords. Detection runs on your device. Your text is never uploaded.

Hide
Original
Scrubbed

Private by design

The page has no server code and uses no AI model. Pattern rules find more than 25 key and token formats, such as AWS, Stripe, GitHub, Slack, Google, OpenAI and Anthropic keys, JWTs and private keys.

Check before you share

Pattern rules cannot know every secret format. Read the result. Add your own project names or hosts to "Always hide these words".

Rotate leaked keys

If a key was already shared, for example in a ticket or a chat, removing it from the text is not enough. Revoke the key and make a new one.

What is secret scrubbing?

Secret scrubbing is the removal of credentials from text before other people see it. A secret is anything that gives access to a system: an API key, an access token, a password, a private key or a database connection string. The tool replaces each one with a label such as [API_KEY], a black block or the word [REDACTED].

Secrets get into text all the time. A debug log prints a request header with a Bearer token. A stack trace shows a database URL with the password in it. A .env file or a config.json is pasted into a ticket to show a setting. Scrubbing keeps the rest of the text as it is, so readers can still follow the logs, but removes the parts that let someone log in as you.

Why use a secrets scrubber tool?

Keys are long, random strings, and they are easy to miss when you read a log by eye. One log file can hold the same token in a header, a URL and an error message. A scrubber checks every line against the known key formats in less than a second.

A leaked key can be used by anyone who sees it. Bots search public repositories, forums and paste sites for keys and try them within minutes. Remove API keys from logs and code before you put them in a bug report, a support ticket, a forum post, a pull request or a prompt to an AI assistant.

How does the Secrets Scrubber work?

  1. Paste your text into the Original pane: logs, a config file, a .env file or code. Or click "Paste an example" to try it.
  2. Choose what to hide with the category buttons: API keys and tokens, passwords, private keys, connection strings, internal hostnames, IP and MAC addresses, and emails. "All URLs" is off at the start.
  3. Choose how to replace it: labels such as [API_KEY], numbered labels such as [API_KEY_1], blocks or [REDACTED].
  4. Check the result. Click any redaction to keep the original value, or add words such as project names or hosts to "Always hide these words".
  5. Copy or download the scrubbed text as a .txt file.

The tool uses pattern rules only. Many providers give their keys a fixed prefix, such as AKIA for AWS access keys, sk_live_ for Stripe or ghp_ for GitHub, and the tool looks for these. It also reads the names in your config: the value after password=, "client_secret": or api_key: is hidden even when it has no known format.

Is my data safe?

Yes. Pasting keys into an online tool that sends them to a server would be a leak in itself. This tool does not do that. The page has no server code and uses no AI model, so there is nothing to download and nothing to upload. The pattern rules run in your browser, and your text never leaves your device.

Read our privacy policy for the details.

What can the Secrets Scrubber find and remove?

  • Cloud and API keys from AWS, Google, OpenAI, Anthropic, Stripe, SendGrid, Twilio, Shopify, DigitalOcean and Hugging Face
  • Code and package tokens from GitHub, GitLab, npm and PyPI
  • Slack tokens and webhook URLs
  • JWTs and auth headers, such as Bearer and Basic tokens
  • Private keys in PEM blocks, such as RSA, EC and OpenSSH private keys
  • Passwords in config files, command-line flags such as --password, and URLs such as https://user:password@host
  • Connection strings for PostgreSQL, MySQL, MongoDB, Redis, SQL Server, AMQP, Kafka, LDAP, FTP and SMTP
  • Named secrets, such as the value of client_secret, api_key, access_key or signing_key
  • Internal hostnames that end in .internal, .local, .corp, .lan or .svc.cluster.local
  • IP addresses, MAC addresses and emails, and all URLs if you turn that on
  • Any words you choose, such as a project name or a customer domain

Who uses a secrets scrubber?

  • Developers who paste error logs, stack traces or config into bug reports, GitHub issues, Stack Overflow or AI coding assistants.
  • DevOps and SRE teams who share CI output, deploy logs or Kubernetes config in incident channels and postmortems.
  • Support engineers who forward customer logs to a vendor or an internal team.
  • Security teams who share examples of a leak in a report without leaking the key again.
  • Technical writers and teachers who use real config files in docs, tutorials or slides.

Secrets Scrubber vs. manual redaction

Manual redaction means reading every line and replacing each key by hand. On a long log, it is easy to miss a token in a URL or a password in a connection string, and "find and replace" only catches a value you already know is there.

The Secrets Scrubber checks the whole text against many key formats at once, gives the same value the same label all through the text, and shows every change so you can check it. It is still good practice to read the result before you share it. For personal data such as names and phone numbers, use the Text Redactor, and for keys in an image, use the Screenshot Redactor.

Frequently asked questions

Is the Secrets Scrubber free?

Yes. The tool is free, with no account, no sign-up and no limit on how often you use it.

Is my text uploaded to a server?

No. The page has no server code and uses no AI model. The pattern rules run in your browser, and your logs, config files and code never leave your device.

Which secret formats does it find?

More than 25 key and token formats, such as AWS, Stripe, GitHub, GitLab, Slack, Google, OpenAI, Anthropic, SendGrid, Twilio, npm, PyPI, Shopify, DigitalOcean and Hugging Face keys. It also finds JWTs, Bearer tokens, private key blocks, passwords, database connection strings, internal hostnames, IP and MAC addresses and emails.

Will it find every secret?

No. Pattern rules find keys with a known format and values next to names such as password, token or api_key. A random string with no known prefix and no name next to it can look like any other text. Always read the result before you share it, and add your own project names or hosts to the always-hide list.

Should I rotate a leaked key?

Yes. If a key was already shared, for example in a ticket, a chat or a public repository, removing it from the text does not make it safe again. Revoke the key with its provider and make a new one. Use the scrubber before you share, not after.

Does it work offline?

Yes. The tool uses no AI model and sends no requests while it works. Once the page has loaded, it can scrub text without a network connection.

Can I use it before I paste logs into ChatGPT or an AI coding assistant?

Yes. Choose numbered labels such as [API_KEY_1] and [API_KEY_2]. The same value gets the same label all through the text, so the assistant can still follow the logs without seeing your real keys.

Can it remove keys from a screenshot or a screen recording?

This tool is for plain text. For images, use the Screenshot Redactor, and for videos, use the Screencast Redactor. Both read the text on the screen and use the same key and password rules.