Mask API keys, passwords and personal data (PII) in logs, stack traces and configs before they go into ChatGPT, GitHub or Slack. Runs entirely in your browser.
Press Ctrl V anywhere on this page, or:
Or drop a text file here. It is read on your device.
Paste something to start. Scanning starts as soon as text arrives.
Known key formats are caught reliably. Plain passwords and names can slip through. Review before you paste.
Paste the log above, copy the cleaned text, and give that to the AI. It takes a few seconds, and the log never leaves your browser.
AWS_ACCESS_KEY_1 or EMAIL_2.Paste the AI's reply. Placeholders like EMAIL_1 turn back into the real values, right here in this tab.
Do not take our word for it. These readings are live, and each one comes with a way to test it without this page.
0network requests from this page since it loaded
Counts every request this page makes once it has fully loaded, with its scan worker, fonts and ad logos. Open DevTools (F12, or Cmd+Option+I on a Mac), pick the Network tab, then paste, restore and make a share image. The list stays empty.
Online. Turn off Wi-Fi and paste again: it keeps working.
Offline copy not ready yet.
Switch on airplane mode and paste the sample again. Once the offline copy is saved, you can even reload the page with no connection.
Secrets and personal data: API keys and tokens, private keys, passwords, emails, IP addresses, card numbers, IBANs and phone numbers. Each type has its own toggle, so you choose what gets masked.
More than 200 key formats from the gitleaks rules, from AWS, GitHub and Stripe to Slack, OpenAI and Anthropic. Also JWTs, Bearer and Basic auth headers, and long random values in configs.
Private key blocks such as RSA, EC, OpenSSH and PGP keys. The whole block becomes one placeholder, like PRIVATE_KEY_1.
Passwords in URLs and database connection strings, and .env, YAML and JSON values whose key is named like password, secret or token.
Email addresses, IPv4 and IPv6 addresses, card numbers that pass the Luhn check, IBANs with a valid checksum, and phone numbers in international or US formats.
Your text goes to a Web Worker, a background thread inside this tab, so even a 5 MB log does not freeze the page. It runs the gitleaks secret rules and the other checks listed under What does PasteSafe detect?
The worker has no network code at all.
Each unique value gets a stable placeholder such as AWS_ACCESS_KEY_1 or EMAIL_2, so the AI's answer still makes sense. The table that maps placeholders back to real values lives only in this tab's memory. Nothing is saved: no cookies, no local storage, no accounts. Close the tab and it is gone.
A small service worker (sw.js) keeps a copy of this site's own files in your browser, so the page can load without a connection. It only requests files from this same site, and it never sees your text, because the page never sends your text anywhere. The connection panel above tells you when that copy is saved.
Known key formats are caught reliably. Plain passwords, names and street addresses in free text can slip through. Read the cleaned text before you paste it.
There is no analytics script. Visitor numbers come from the hosting dashboard, which needs nothing on the page. The ads are plain links to our own apps, with their logos served from this site.
Only after you remove the secrets and personal data. Logs often hold API keys, session tokens, emails and IP addresses, and once you send a message it is stored on the AI provider's servers, out of your control. Paste the log here first and send the cleaned copy instead.
The main concern is that everything you paste is kept on someone else's servers. Depending on your plan and settings, chats may be stored, reviewed or used to improve models, and a leaked API key keeps working until you rotate it. Masking before you paste keeps keys and customer data out of the chat.
PII masking replaces personally identifiable information, such as emails, phone numbers and card numbers, with placeholders, so text can be shared without exposing the people in it. PasteSafe gives each unique value its own placeholder, like EMAIL_1, so the AI can still tell values apart. It does not mask names.
Paste the log into the editor and copy the cleaned text: emails, IP addresses, card numbers, IBANs and phone numbers are replaced automatically. For logs your apps write every day, also mask PII in your logging code, so it never reaches the log files in the first place.
Paste the log or stack trace here and copy the cleaned version, where known key formats become placeholders like STRIPE_KEY_1. The redacted API key never leaves your browser. If the key was already shared or committed to GitHub, rotate it as well: removing it from a log or from git history does not revoke it.
Yes. Drop a text file onto the editor and it is read and cleaned on your device in one pass, even a 5 MB log. Above 300 KB or 5,000 lines the highlights and animation switch off, but every line is still masked.
No. The scan runs in a background thread inside this tab, the page's Content Security Policy forbids it from opening network connections, and nothing is saved to cookies or local storage. The Check it yourself panel counts network requests live, so you can verify it.
Yes. Paste the AI's reply into Put the real values back and every placeholder turns back into its original value, in this tab only. Close the tab and the mapping is gone.
Step by step help, with command line alternatives: read the guides on masking PII in logs, sanitizing HAR files and what to do after an API key leaks.
Bans push people to paste in secret. A cleaner that runs in the browser keeps them using AI, and keeps keys and customer data out of it.