Is anything uploaded?

No. The scan runs in your browser using pattern matching and entropy checks. Nothing is sent anywhere, which is the entire point of a tool you paste secrets into.

Will it catch every secret?

No, and you should not rely on it as your only check. It knows the common formats (AWS, GitHub, Stripe, OpenAI, Slack, Google, private key blocks, JWTs) and flags high-entropy strings that look like credentials. A custom internal token format may slip through, so read the output before sharing it.

Does it change the meaning of my code?

Placeholders keep the shape of what they replace, and the same secret always maps to the same placeholder, so the text stays readable and a reader can still tell two different keys apart.

What counts as high entropy?

A long run of mixed-case letters and digits with no dictionary structure — the shape of a generated credential rather than a word. It is a heuristic, so it is reported separately from the confident pattern matches.

Secret Redactor – Free Online Tool

Find and mask API keys, tokens, emails, and private keys in code or logs before you share them.

✦ FreeNo SignupInstantSecurity Prompt Engineering Guide Is It Safe to Paste JSON Into an Online Formatter?

Everything here runs in your browser. Nothing you paste is uploaded, logged, or sent anywhere — which is rather the point of a tool you feed secrets to.

Paste code, config, or logs

Email addressesIP addressesHigh-entropy strings

5 known credentials found.

Redacted

# .env.production
AWS_ACCESS_KEY_ID=[REDACTED_AWS_ACCESS_KEY_1]
OPENAI_API_KEY=[REDACTED_OPENAI_KEY_1]
DATABASE_URL=[REDACTED_CONNECTION_STRING_1]

// support ticket #4821 from [REDACTED_EMAIL_1]
fetch("/api/sync", {
  headers: { Authorization: "Bearer [REDACTED_JWT_1]" },
});

What was found

AWS access key id1 occurrence · line 2

AKIAIOSFODNN… → [REDACTED_AWS_ACCESS_KEY_1]

OpenAI API key1 occurrence · line 3

sk-proj-9fKq… → [REDACTED_OPENAI_KEY_1]

Database connection string1 occurrence · line 4

postgres://a… → [REDACTED_CONNECTION_STRING_1]

Email address1 occurrence · line 6

dev@example.… → [REDACTED_EMAIL_1]

JSON Web Token1 occurrence · line 8

eyJhbGciOiJI… → [REDACTED_JWT_1]

Example

Input

AWS_KEY=AKIAIOSFODNN7EXAMPLE
const token = "sk-proj-abc123def456ghi789jkl012mno345pqr";
contact: dev@example.com

Output

AWS_KEY=[REDACTED_AWS_ACCESS_KEY_1]
const token = "[REDACTED_OPENAI_KEY_1]";
contact: [REDACTED_EMAIL_1]

Each secret is replaced by a labelled placeholder. The numbering means you can still tell two different keys apart in the redacted text.

How to Use Secret Redactor

1
Paste
Drop in the code, config, or log output you were about to share.
2
Review
Each finding is listed with its type and line so you can see what was caught and why.
3
Copy the clean version
Copy the redacted text, with secrets replaced by labelled placeholders.

What is Secret Redactor?

Pasting real code into a chat window is now part of everyday debugging, and it is the easiest way to leak a credential without noticing. The Secret Redactor scans text for the key formats the major providers use, spots private key blocks and JSON Web Tokens, and flags high-entropy strings that look generated rather than written. Findings are grouped by type so you can see what it caught before you trust the result. The scan happens entirely in your browser: a tool that asks you to paste your secrets somewhere else would defeat its own purpose.

Common Use Cases

✦Scrubbing a stack trace or config file before pasting it into an AI assistant
✦Cleaning logs before attaching them to a bug report or support ticket
✦Checking a snippet for leaked credentials before committing it
✦Sanitising output before sharing a screen recording or blog post

Share a link to this tool. Results can be passed via URL parameters.

https://buildutilities.com/share/secret-redactor

Frequently Asked Questions

More Security Tools

Security-focused tools for passwords, tokens, and cryptography.

💪 Password Strength Checker 🪙 JWT Decoder H# HMAC Generator 🛡 CSP Header Generator 🔐 SSH Key Fingerprint 🔒 Bcrypt Hash Generator

View all Security tools