Why use this tool?
- Review logs, configuration, or support text before sharing it.
- See masked finding metadata without duplicating complete secrets in the results list.
- Copy or download a redacted version that preserves useful surrounding context.
Secret Scanner & Redactor
Find likely credentials in pasted text and replace them without exposing full values in the findings list.
Runs locally in your browser
Detects private keys, JWTs, bearer tokens, service tokens, and named credentials.
Pattern matches require review. Harmless examples can match, and uncommon secrets can be missed. If a real credential was exposed, revoke or rotate it; redaction does not make the original value safe.
Potential secrets
4 findings
1 Private keys · 1 JWTs · 1 Bearer tokens · 1 Credentials
Assigned credential
Review match••••••••Line 2, column 18 · 31 characters
Bearer token
High confidence••••••••Line 3, column 23 · 34 characters
JSON Web Token
High confidence••••••••Line 4, column 13 · 96 characters
Private key material
High confidence••••••••Line 6, column 1 · 36 characters
Redacted text
# Synthetic demo values only — none of these credentials work SERVICE_API_KEY="[REDACTED CREDENTIAL]" Authorization: Bearer [REDACTED BEARER TOKEN] session_jwt=[REDACTED JWT] -----BEGIN PRIVATE KEY----- [REDACTED PRIVATE KEY] -----END PRIVATE KEY-----
Complete tool guide
Secret Scanner & Redactor guide
The Secret Scanner & Redactor looks for common credential shapes in pasted text and replaces potential secrets while leaving the surrounding content intact.
Scanning and redaction run entirely in the current browser tab. The tool does not upload, validate, revoke, or use any detected value.
Common use cases
- Removing credentials from logs before attaching them to a ticket
- Checking a configuration snippet for accidentally pasted tokens
- Redacting private-key material and authorization headers from notes
How to use it
- 1
Paste the text you want to review.
- 2
Inspect each masked finding and its line and column.
- 3
Check the redacted output for missed secrets and false positives.
- 4
Copy or download the result, then clear the input on shared devices.
Recognized patterns
The scanner recognizes PEM and PGP private-key material, JWTs, bearer tokens, common provider token formats, named credential assignments, and passwords embedded in supported connection URLs.
Deterministic redaction
When patterns overlap, the more specific high-confidence match wins. Only the selected secret range is replaced, so labels, quotes, authorization schemes, PEM boundaries, and unrelated text remain available for context.
Pattern matching limits
A match is not proof that a value is active, and an uncommon or obfuscated credential may be missed. Treat this as a review aid rather than a substitute for repository scanning, secret-manager controls, or incident response.
Practical tips for better results
- Review every result before sharing; automated redaction can have false positives and false negatives.
- If a real credential may have been exposed, revoke or rotate it instead of relying on redaction alone.
- Avoid pasting production secrets on shared or untrusted devices, even when processing is local.
Frequently asked questions
Does the scanner upload or validate secrets?
No. Detection and redaction stay in this browser tab, and the tool never contacts a provider or attempts authentication.
Can the scanner guarantee that text is safe to share?
No. Pattern matching can miss unusual credentials and can flag harmless examples. Manually review the complete redacted output before sharing it.
What should I do after finding an exposed real secret?
Revoke or rotate the credential, remove it from accessible history where appropriate, and follow your incident-response process. Masking the text does not invalidate the original credential.
Keep working
Related cybersecurity tools
Continue with another focused tool from the same collection.
File Hash & SRI GeneratorHash local files with SHA-256, SHA-384, or SHA-512 and generate Subresource Integrity values without uploading them.IOC DefangerDefang URLs, domains, IP addresses, and email addresses for safer sharing in reports and tickets.IOC RefangerRestore common defanged IOC spellings locally for analysis without opening or resolving them.IOC ExtractorExtract, normalize, categorize, and deduplicate common indicators from incident text or threat reports.