welcome.txt

Redact secrets before you share a log.

Paste a log, a config, or a stack trace. SpyMonk Redact replaces passwords, tokens, private keys, cookies, emails, and home-folder names with placeholders, and leaves the rest of every line untouched.

Local. The engine runs in your browser as WebAssembly. Nothing is uploaded.
Exact. Only matched values change; line breaks, spacing, and encoding are kept byte for byte.
Honest. Pattern matching misses what it cannot recognize. Always review before sharing.

Open the playground See what it finds

playground.exe

Input

Up to 1 MiB. Your text stays on this device.

Sanitized output

Report

rules

Rule set 1.0.0, SHA-256 168d71feabe6c55ef378594064a9d987418d36edf91c16ca5e4a27fb99066cc3. When rules overlap, the higher one in this order wins: SR-008 › SR-007 › SR-002 › SR-009 › SR-001 › SR-003 › SR-004 › SR-005 › SR-006.

SR-001

Named secret values

Always on

Redacts the value assigned to a key whose final segment names a secret, such as password=, DB_PASSWORD=, "clientSecret": or --password. Keys are split into segments at _, -, . and camel-case transitions.

Replaced with [REDACTED]

Examples

Input	Output
`password=fake-value`	`password=[REDACTED]`
`export GITHUB_TOKEN=fake`	`export GITHUB_TOKEN=[REDACTED]`
`"clientSecret": "fake"`	`"clientSecret": "[REDACTED]"`
`--password fake --verbose`	`--password [REDACTED] --verbose`

Left unchanged

password_length=16
token_type=Bearer
max_tokens=10
password=null

Limitations

Unquoted values end at whitespace, , ; & quotes and brackets, so an unquoted password containing those characters is only partly redacted; quoted values are fully handled.
Multi-line strings, arrays, and objects are not treated as assigned values.

SR-002

Authorization credentials

Always on

Redacts the credential in Authorization and Proxy-Authorization fields while keeping a recognized scheme name. Parameterized schemes such as Digest are redacted to the end of the field; when the first word is not a recognized scheme, the whole field is redacted.

Replaced with [REDACTED]

Examples

Input	Output
`Authorization: Bearer fake-token`	`Authorization: Bearer [REDACTED]`
`"authorization": "Basic ZmFrZTpmYWtl"`	`"authorization": "Basic [REDACTED]"`

Left unchanged

Authorization: [REDACTED]

Limitations

Credentials are never decoded; header names other than the two listed are not covered.
An unrecognized scheme name is redacted together with its credential.

SR-003

URL credentials

Always on

Redacts the password in scheme://user:password@host for any scheme, keeping scheme, user, host, port, path, query, and fragment.

Replaced with [REDACTED]

Examples

Input	Output
`postgresql://app:fake-pass@db/app`	`postgresql://app:[REDACTED]@db/app`
`jdbc:mysql://root:fake@10.0.0.5:3306/x`	`jdbc:mysql://root:[REDACTED]@10.0.0.5:3306/x`

Left unchanged

https://user@host/path
https://host:8443/path

Limitations

User information without a password separator is not covered; reserved delimiters inside passwords must be percent-encoded.

SR-004

Home-directory usernames

Always on

Redacts the username segment of /home/<user>, /Users/<user>, and C:\Users\<user> paths, including JSON-escaped Windows separators, keeping the rest of the path.

Replaced with [USER]

Examples

Input	Output
`/home/alex/app/config.yml`	`/home/[USER]/app/config.yml`
`C:\Users\alex\app.log`	`C:\Users\[USER]\app.log`
`HOME=/home/alex`	`HOME=/home/[USER]`

Left unchanged

see https://example.com/home/about/
/home/1001/

Limitations

UNC paths, ~user, C:\Documents and Settings\, and personal names elsewhere in text are not covered.

SR-005

Email addresses

On by default

Redacts email-shaped strings using a pragmatic ASCII grammar. Inside a URL authority, only the username part can match.

Replaced with [EMAIL REDACTED]

Examples

Input	Output
`user=alex@example.com`	`user=[EMAIL REDACTED]`

Left unchanged

alex@localhost
postgresql://app:pw@db.example/app

Limitations

Quoted local parts, internationalized addresses, address literals, and single-label domains are not covered.

SR-006

Private IP addresses

Off by default

Redacts RFC 1918 IPv4 addresses and IPv6 unique-local addresses, keeping ports, CIDR suffixes, zone identifiers, and URL brackets.

Replaced with [PRIVATE IP REDACTED]

Examples

Input	Output
`host=10.0.0.8:5432`	`host=[PRIVATE IP REDACTED]:5432`
`addr=[fd12:3456::1]:443`	`addr=[[PRIVATE IP REDACTED]]:443`

Left unchanged

host=172.32.0.1
110.0.0.1
10.0.0.256

Limitations

Public, loopback, link-local, shared-address-space, and integer or hexadecimal IP encodings are not covered.

SR-007

Known credential formats

Always on

Redacts tokens with a documented, prefix-identifiable format wherever they appear. A run longer than the minimum is redacted whole.

Replaced with [REDACTED]

Examples

Input	Output
`key AKIAFAKEFAKEFAKE0000`	`key [REDACTED]`

Left unchanged

AKIA-not-a-key
ghp_short

Limitations

Only the formats listed are recognized; high-entropy strings without a known prefix need a named key.

SR-008

Private-key blocks

Always on

Redacts the body of PEM and OpenSSH private-key blocks, multi-line or escaped on one line, keeping the armor lines and the line count.

Replaced with [PRIVATE KEY REDACTED]

Examples

Input	Output
`"pem": "-----BEGIN PRIVATE KEY-----\nFAKE\n-----END PRIVATE KEY-----"`	`"pem": "-----BEGIN PRIVATE KEY-----[PRIVATE KEY REDACTED]-----END PRIVATE KEY-----"`

Left unchanged

-----BEGIN CERTIFICATE-----
-----BEGIN PUBLIC KEY-----

Limitations

An unterminated block is redacted to the end of the input and reported with a warning.
PuTTY .ppk files and binary or base64-wrapped key containers are not covered.

SR-009

Cookie values

Always on

Redacts cookie values in Cookie and Set-Cookie fields, keeping cookie names and Set-Cookie attributes.

Replaced with [REDACTED]

Examples

Input	Output
`Cookie: sid=fake; theme=dark`	`Cookie: sid=[REDACTED]; theme=[REDACTED]`
`Set-Cookie: sid=fake; Path=/; HttpOnly`	`Set-Cookie: sid=[REDACTED]; Path=/; HttpOnly`

Left unchanged

Cookie: sid=[REDACTED]

Limitations

Cookies passed in other fields are covered only when their key names a secret (SR-001).

install & verify

Not released yet. No package, archive, or container image has been published. Do not install anything named spymonk-redact from a registry until a signed release appears in the repository.

Planned channels

pip, pipx, or uv: a wheel that carries the native command-line binary.
Standalone archives for Windows, macOS, and Linux on x86-64 and ARM64.
A container image with a pinned digest.
This playground, plus an offline bundle you can serve from your own machine.

How you will verify a release

Every artifact will ship with a checksum, Sigstore-signed build provenance, and a software bill of materials. You will check provenance with gh attestation verify, compare checksums with sha256sum --check, and confirm that spymonk-redact --version prints the rule-set hash listed in the release notes. This page’s rule set is 168d71feabe6c55ef378594064a9d987418d36edf91c16ca5e4a27fb99066cc3.

Build from source

git clone https://github.com/shubhajeet1207/redact
cd redact
cargo test --workspace --locked
cd web && npm ci --ignore-scripts && npm run build

The build needs the Rust toolchain pinned in rust-toolchain.toml, wasm-bindgen-cli 0.2.129, and Node.js 22.13 or later.

security & privacy

What this page does with your data

Pasted text and chosen files are processed in this browser tab and never leave the device.
No cookies, no browser storage, no analytics, and no third-party resources. Your input never appears in a URL.
The page’s policy forbids network connections from both the page and the engine.
Leaving the page clears the editor, the output, and the engine.
The web host still sees ordinary request details, such as your IP address and browser, in its access logs.

What it cannot do

It finds only what its rules recognize. High-entropy strings without a key or known prefix, credentials split across lines, and personal names are not detected.
Redaction does not undo a disclosure. Rotate any credential that was already exposed.
Each visit trusts the host to deliver unmodified code. For sensitive material, use the command-line tool or the verified offline bundle.
Browser extensions can read pages; they are outside the tool’s control.

Report a problem

Report vulnerabilities privately through the repository’s security advisories. The contact details are also in security.txt. Never include real credentials or logs: reproduce with synthetic values.