Configuration Secret Redactor
About Configuration Secret Redactor
Configuration Secret Redactor removes likely credentials from JSON, YAML, TOML and .env files before logs, bug reports or examples are shared.
How it works
Key and value detection
The scanner recognizes common password, token, API key, credential, private key, connection string, database URL and DSN names, plus credential-bearing URLs, JWTs, private-key blocks and common token prefixes.
Format-aware transformation
JSON, YAML and TOML are parsed before values are changed; .env uses the shared strict parser. YAML comments stay attached, while other semantic serializers normalize source presentation.
Three redaction modes
Mask uses a fixed marker, Remove deletes the property or variable, and SHA-256 emits a deterministic fingerprint for matching repeated secrets without retaining the original text.
Frequently asked questions
Can automatic detection guarantee every secret is found?
No. Review the output before sharing. Domain-specific names and unusual token formats can evade heuristic detection.
Is a SHA-256 fingerprint always safe?
Not for predictable low-entropy values. Fingerprints are useful for correlation but can be guessed; use Mask or Remove for safer public sharing.
Does redaction upload the configuration?
No. Detection, parsing, hashing and serialization happen locally in your browser.
Sources & last verified
The behaviour of this tool and the claims on this page were checked against the specifications below on . Everything runs in your browser, so the output you see is exactly what the engine produced.
Found a wrong result or an outdated claim? Report an error and it will be re-verified.