PII and Secret Redactor

Redact emails, phone numbers, card numbers, IPs, tokens and keys out of logs or documents before you share them, with every detector reviewable and nothing uploaded.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Text to redact

Or drop a text file

Up to 8 MB. Read locally.

Placeholder style

The same value always becomes the same placeholder

This sounds like a detail and is the difference between a usable redacted log and an unreadable one. If 10.14.3.88 becomes [IPV4-1] in one line and [IPV4-7] three lines later, nobody can tell whether the same host was involved in both events - and that is usually the entire question being asked.

So placeholders are assigned per distinct value, consistently through the document. The stable token option goes further and derives the placeholder from the value itself, so the same address gets the same token across separate files and separate days. That lets two redacted logs be correlated without either revealing what was redacted. It is not a security function - anyone holding a candidate value can confirm it by hashing - and it is labelled as such on the page.

What a pattern can and cannot find

Structured identifiers have a shape: an email address, a card number, an API key, an IP address. Those are findable and are found here, with the matching deliberately biased towards over-matching because a redactor that misses something is worse than none at all - the person trusted it and posted the output.

Names, addresses, job titles and anything described in prose have no shape. No regular expression will ever find "reported by the night manager at the Croydon site". Every result says so, and the matches are listed so you can check them rather than trust them.

Card numbers are checked, not just matched

The pattern for a payment card is "13 to 19 digits", which also describes order numbers, timestamps and transaction references. Every candidate is run through the Luhn checksum that real card numbers satisfy, which removes almost all the false positives at no cost. Social security numbers get the same treatment against their allocation rules.

Redacting a secret does not un-leak it

If a credential appeared in the text you pasted, it has already been somewhere it should not be - a log file, a ticket, a repository, a screenshot. Removing it from your copy changes nothing about that. Rotate it. The result says this every time a credential pattern matches, because it is the step people skip.

Nothing is uploaded

The text you paste is by definition the text containing the secrets. It is processed entirely in your browser and never transmitted.

Frequently asked questions

Can I get the original values back?

Yes - the mapping export lists every placeholder against what it replaced, because investigations usually need to re-identify later. That file is exactly as sensitive as the original text, so keep it somewhere the redacted copy is not going.

Why are phone numbers off by default?

Because the pattern matches far too much - version numbers, IDs, timestamps. Turn it on when you know the text contains phone numbers and check the matches afterwards.

It redacted something that was not sensitive.

Over-matching is the deliberate bias, since the alternative failure mode is publishing a secret. Every match is listed so you can spot that, and turning off the rule that caused it is one checkbox.

Is this enough to share a log publicly?

It is a first pass that removes the mechanical work. Read the output before sharing - there is no tool that can decide what counts as sensitive in your context.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.