← All Tools
API Key Redactor🔒 100% local
Scrub secrets from JSON. Privacy-first, no server uploads, no tracking.
Related Tools
Runs pasted text against a set of regular expressions for well-known credential shapes and replaces every match with a redaction marker, reporting a count per pattern and printing the scrubbed copy underneath. The scan happens in the page, so the secret you are trying to clean up is not sent anywhere while you clean it.
How to use it
- Paste the config, log line or curl command into the box.
- Press Process once the text is in, and the counts appear above the scrubbed copy.
- Read the count list, then copy everything under Safe to share and read it once more before sending it on.
Worked example
curl -H "Authorization: Bearer 0987654321abcdefghij" https://api.example.com/v1/mebecomesRedacted 1 secrets from 82 chars:
1× Bearer token
Safe to share:
curl -H "Authorization: Bearer [REDACTED]" https://api.example.com/v1/meThe surrounding command is untouched, so the redacted line still runs as a template. The summary line reads 1 secrets regardless of the count.
{"api_key":"sk-abcdEFGH1234ijklMNOP"}becomesRedacted 2 secrets from 37 chars:
1× OpenAI-style secret key
1× key/secret assignment
Safe to share:
{"api_key":""[REDACTED]"}Two rules match the one key, so the count reads 2, and the replacement leaves a doubled quote behind in the JSON.
nothing secret herebecomesNo known secret patterns found in 19 chars.
Supported: OpenAI sk-*, GitHub gh*_*, AWS AKIA*, Google AIza*, Slack xox*,
JWTs, Bearer tokens, private key blocks, key/secret/token assignments in quotes,
and credentials embedded in mongodb/postgres/mysql/redis URIs.
Your text is unchanged:
nothing secret hereWhen to use it
- Attaching a failing request to a bug ticket and wanting the token gone before it is filed.
- Checking a .env file or an application config before it goes into a shared screenshot.
- Cleaning a log excerpt that captured an Authorization header from a proxy or a retry.
What it does not do
- It matches known shapes only. A bespoke token, a short password or an opaque base64 blob passes straight through, so read the output rather than trusting the label.
- One credential can trip more than one rule. A GitHub ghp_ token is reported twice, once as GitHub token and once as GitHub PAT, so the total is not a count of distinct secrets.
- Routine substitutions are not always valid syntax: {"api_key":"sk-..."} comes back as {"api_key":""[REDACTED]"}, which no longer parses as JSON.
- It is a text scan, not a schema walk. An assignment without a quoted key name, or one under a name the patterns do not list, is untouched: both api-key: 8f3k29fj20fj29fj2 and {"credential":"hunter2secret"} came back unchanged.