Mask API keys, passwords and customer data in logs and configs before they go into ChatGPT, GitHub or Slack. Runs entirely in your browser.
Press Ctrl V anywhere on this page, or:
Or drop a text file here. It is read on your device.
Paste something to start. Scanning starts as soon as text arrives.
Known key formats are caught reliably. Plain passwords and names can slip through. Review before you paste.
Paste the AI's reply. Placeholders like EMAIL_1 turn back into the real values, right here in this tab.
Do not take our word for it. These readings are live, and each one comes with a way to test it without this page.
0network requests from this page since it loaded
Counts every request this page makes once it has fully loaded, with its scan worker, fonts and ad logos. Open DevTools (F12, or Cmd+Option+I on a Mac), pick the Network tab, then paste, restore and make a share image. The list stays empty.
Online. Turn off Wi-Fi and paste again: it keeps working.
Offline copy not ready yet.
Switch on airplane mode and paste the sample again. Once the offline copy is saved, you can even reload the page with no connection.
Your text goes to a Web Worker, a background thread inside this tab, so even a 5 MB log does not freeze the page. It runs the gitleaks secret rules (more than 200 formats, from AWS and GitHub to Stripe and Slack), plus checks for private key blocks, JWTs, Bearer headers, passwords in URLs and connection strings, .env lines, emails, IP addresses, card numbers (Luhn check), IBANs (checksum) and phone numbers.
The worker has no network code at all.
Each unique value gets a stable placeholder such as AWS_ACCESS_KEY_1 or EMAIL_2, so the AI's answer still makes sense. The table that maps placeholders back to real values lives only in this tab's memory. Nothing is saved: no cookies, no local storage, no accounts. Close the tab and it is gone.
A small service worker (sw.js) keeps a copy of this site's own files in your browser, so the page can load without a connection. It only requests files from this same site, and it never sees your text, because the page never sends your text anywhere. The connection panel above tells you when that copy is saved.
Known key formats are caught reliably. Plain passwords, names and street addresses in free text can slip through. Read the cleaned text before you paste it.
There is no analytics script. Visitor numbers come from the hosting dashboard, which needs nothing on the page. The ads are plain links to our own apps, with their logos served from this site.
Bans push people to paste in secret. A cleaner that runs in the browser keeps them using AI, and keeps keys and customer data out of it.