Secret Detector & Redactor

No. Detection and redaction run entirely client-side with regular-expression pattern matching. The input is never sent to a server, added to the URL, saved to local storage, or logged to analytics.

Conservative mode only reports high-confidence patterns (private keys, AWS/GitHub/Slack/Stripe/Google keys, JWTs, bearer tokens, connection-string credentials) that are unlikely to be false positives. Aggressive mode adds broader, noisier patterns — generic key/password-named assignments, emails, and IP addresses — that need more manual review.

No. This is a heuristic pattern matcher, not a security audit. It can miss secrets that don't match a known format and can flag things that aren't actually sensitive. Always review the findings and the redacted output yourself before sharing.

Every occurrence of the exact same secret value anywhere in the input is replaced with the same numbered placeholder (like [REDACTED-JWT-1]), so you can still see that the same token repeats without revealing what it is.