Prompt Secret Redactor
🔒 In your browserMask API keys, tokens & PII in a prompt before you send it to an LLM.
How it works
Paste a prompt, log, or document and this finds and masks API keys, tokens, private keys, emails, phone and card numbers before you send it to an AI assistant. Detection and redaction happen entirely in your browser — nothing is uploaded.
Pattern-based detection can miss unusual secret formats or flag look-alikes — always eyeball the result before sharing. Best practice is still to never paste production credentials into any tool. Your text stays in your browser.
About the Prompt Secret Redactor
Pasting a log, stack trace or config into ChatGPT or Claude is an easy way to leak an API key without noticing. This free prompt redactor scans your text for secrets and personal data — API keys, tokens, private keys, emails, phone and card numbers — and masks them so you can share the text safely.
All detection and redaction happen entirely in your browser; the text you paste is never uploaded.
What it detects
- Provider API keys — OpenAI, Anthropic, Google, Stripe, GitHub, AWS, Slack and other common formats.
- Tokens & keys — JWTs and PEM private keys.
- Personal data — email addresses, phone numbers and card numbers (validated with a Luhn check).
- Hidden characters — invisible unicode that can smuggle content past a human reviewer.
Why redact before using an LLM
Prompts you send to a hosted AI service leave your machine and may be logged or retained. If a prompt contains a live credential, that secret is now outside your control and should be rotated. Redacting first keeps the useful context — the error, the structure, the question — while removing the parts that are dangerous to share.
Frequently asked questions
Does the redacted text get sent anywhere?
No. Both the detection and the masking run in your browser using pattern matching. Nothing you paste — original or redacted — is uploaded.
Will it catch every secret?
No. It recognises common key and PII formats, but unusual or custom secret shapes can slip through, and ordinary text can occasionally be flagged. Always review the redacted output before sharing it.
If a key was already exposed, is redacting enough?
No. If a real credential has been pasted somewhere it shouldn't be, treat it as compromised and rotate it. Redaction prevents future exposure; it can't undo past exposure.
What does the masking look like?
Long secrets keep their first and last few characters with the middle replaced by dots (so you can still recognise which key it was), and short values are fully masked.
Can I use this for GDPR / PII scrubbing?
It helps spot obvious personal data like emails and phone numbers, but it isn't a compliance tool. Use it as a quick safety check, not as your only safeguard.
Related searches
Related Developer tools
🔗 Embed this tool on your website — free
Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.
<iframe src="https://toolhq.dev/embed/prompt-secret-redactor/" title="Prompt Secret Redactor — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>Optional: auto-resize the iframe height
Add this once on the same page so the iframe grows to fit the tool:
<script>
addEventListener("message", function (e) {
if (e.data && e.data.type === "toolshub:resize") {
document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
});
}
});
</script>