Redact a log file
Runs locally in your browser. Your file never leaves your device.
By processing a file or pasted text here, you agree to the Terms.
Drop a log file here — or
Plain-text logs in any format, up to 20 MB.
…or paste log text instead
Review these — possibly secret
Random-looking strings that match no known secret format. They were not redacted, because a high-entropy string can be a session token or just a checksum — only you can tell. Their lines are marked in the redacted pane below.
Original
Redacted
Why redact a log before sharing it
When a support ticket, a GitHub issue template, or an AI chat asks you to “attach the log,” the file usually contains far more than the error you are debugging: customer email addresses, internal IP addresses, session tokens, API keys someone once printed “temporarily,” and passwords that leaked into a connection string. Once that file lands in a ticket system, a public issue, or a chat transcript, you no longer control where it goes.
The obvious catch: an online “log cleaner” that uploads your file to its server is precisely the thing you are trying to avoid. This page cannot upload anything — it is a static page with no backend. The redaction runs in your browser, on your machine, and the file never exists anywhere else.
What it finds, and how it replaces it
The detector covers email addresses; IPv4 and IPv6 addresses (full,
compressed :: notation, zone IDs like %eth0,
and IPv4-embedded forms); JSON Web Tokens; AWS access key IDs and secret
access keys; Bearer and Basic authorization tokens; and values assigned
to credential-shaped keys — password=…,
db_password: …, "apiKey": "…" — across
key=value, YAML-style, and JSON syntax. Quoted values keep their quotes,
so structured logs stay parseable.
Every detected value is replaced with a deterministic token such as
[EMAIL-1] or [IPV4-3], numbered in first-seen
order. The same value always becomes the same token, which matters more
than it sounds: the person reading your redacted log can still tell that
one client retried forty times or that two errors belong to the same
session. The log stays debuggable; the detected secrets are gone.
A second, deliberately humble layer runs after the patterns: anything that looks random — long high-entropy strings such as hex digests or base64 blobs — is flagged as “possibly secret” for you to review. Flagged strings are never replaced automatically, because a checksum and a session token look identical from the outside, and only you know which one your log holds.
What it can miss — read this before you share
Detection is pattern-based and best-effort — expand for what can slip through.
Pattern-based detection is incomplete by construction, and any tool that
claims otherwise is overpromising. Things this tool will not catch:
people’s names in free-form text, internal ticket or customer ID
schemes, hostnames that don’t look like addresses, secrets that wrap
across lines, and passphrases made of ordinary words, which score like
prose. The suspicious-string flagger is best-effort too: random tokens
shorter than about 20 characters slip under its statistical floor. It
can also over-redact: a version-like string such as
v1.2.3.4 looks identical to an IP address, and masking it
is the safer failure. The side-by-side preview highlights exactly which
lines changed so that a final human review — the step no tool can
replace — takes seconds, not minutes.
Sharing a single stack trace rather than a whole log? The stack trace cleaner runs the same engine plus trace-specific masking for usernames in frame paths, local path prefixes, and context-pinned hostnames. Sharing a tabular data sample instead? The CSV sample anonymizer masks PII by column so a customer export stays safe to hand over. Sharing an access log where the visitor IP addresses are the main concern? The access-log IP anonymizer truncates them GDPR-style — or tokenizes them — while masking the same secrets this tool does. Only want to know whether there’s a secret in the file, without changing it? The secret scanner reports what it finds and leaves the file untouched.
Practical limits
Files are processed entirely in memory with a practical ceiling of about 20 MB; nothing persists after the tab closes. Redacting a full 20 MB log takes about two seconds on a typical desktop (measured ~1.4 s in our test suite); older hardware takes proportionally longer, and the tab stays busy while it runs. The page works offline once loaded. If your log is larger, split it by day or by service and redact the slice you actually need to share.
Frequently asked questions
Is my log file uploaded anywhere?
No. This is a static page with no server behind it — there is nothing to upload to. The file is read and redacted by JavaScript running in your browser, and it exists only in this tab’s memory. You can verify this yourself: open your browser’s DevTools, watch the Network tab, and load a file — no request carries your data.
What kinds of secrets does it detect?
Email addresses, IPv4 and IPv6 addresses (including compressed :: forms and zone IDs), JSON Web Tokens, AWS access key IDs and secret access keys, Bearer and Basic authorization tokens, and values assigned to password/secret/token/api-key style keys in key=value, key: value, and JSON forms. A second layer flags long random-looking strings — hex digests, base64 blobs — as “possibly secret” for manual review without redacting them. Everything else passes through unchanged.
Why do repeated values get the same token?
The redactor replaces each distinct value with a stable token like [IPV4-1], assigned in first-seen order. Every later occurrence of the same value gets the same token, so whoever reads the redacted log can still see that one client kept retrying or one session spans twenty lines — the structure survives, the value does not.
Can the redaction miss secrets?
Yes. Pattern-based detection is incomplete by construction: customer names in free text, internal ID schemes, hostnames, secrets split across lines, or passwords made of ordinary words will not be caught, and random tokens under about 20 characters evade the suspicious-string flagger as well. The side-by-side preview highlights every change and marks flagged lines so you can review before sharing. Never treat any automated redaction — this one included — as guaranteed.
What is the maximum file size?
About 20 MB, because the whole file is processed in your browser’s memory. For bigger logs, split them first — by day, by service, or with head/tail — and redact the part you actually need to share.
Does it work with JSON or logfmt logs?
Yes. Detection is format-agnostic and quoted values keep their quotes, so structured logs stay parseable after redaction. A JSON log line with "apiKey": "…" comes out as "apiKey": "[SECRET-1]" — still valid JSON.