Secret Scrubber

Paste a log, stack trace, or .env fragment, find the secrets and personal data in it, and replace them with safe placeholders before you paste it into an AI chat.

Everything happens on your device. Nothing you type here is sent anywhere.

Paste text to scan

Paste something above and click "Find secrets" to see what it catches. Try "Load example" first if you want to see it work in a few seconds.

What it checks

Detection runs in three passes over the pasted text, in this order, and every pass is a plain function in core.js:

Known key formats: AWS access keys (AKIA/ASIA prefix), a keyword-anchored AWS secret key, OpenAI keys (sk-), Anthropic keys (sk-ant-), Google API keys (AIza), GitHub tokens (ghp_, gho_, and related prefixes), Slack tokens (xox), JWTs (three base64url segments), and PEM private key blocks.
Shannon entropy pass: any remaining token of 20 or more characters (split on whitespace and on = : , ;, since .env lines and log fields often have no surrounding space) is scored for randomness. A token at or above 4.2 bits of entropy per character is flagged as a high-entropy secret even though it matches no known key format. URLs are excluded from this pass so long paths do not get flagged.
PII regex: email addresses and US-style phone numbers. Addresses on example.com/.org/.net/.edu and phone numbers in the 555-0100 to 555-0199 range are recognized as already-reserved placeholder values and are not flagged, which is also what the scrubber's own replacements use.

Known limits: this is a heuristic scanner, not an exhaustive one. It will miss secrets embedded inside a URL's query string, and it can occasionally flag a long random-looking value (like a full docker image digest) that is not actually sensitive. It is not a replacement for a git-history scanner like gitleaks.

Clicking "Copy scrubbed text" re-scans the scrubbed output first. The button only becomes clickable once that re-scan shows zero findings.