Sensitive Data Masker

There is a moment in every incident where you are about to paste a log somewhere: a ticket, a chat channel, a support forum, a shared dashboard. And in that log, somewhere in the middle of thousands of routine lines, sits a real secret — an OAuth bearer token, a database password in a connection string, a customer email address, an internal IP. One paste is all it takes to leak it. Sensitive Data Masker exists to make that moment safe.

Paste your log, pick which patterns to apply (IPv4/IPv6 addresses, emails, bearer tokens, API keys, passwords, JWTs, AWS keys, credit-card-like numbers, or your own regular expressions), and run. Every match is replaced by a mask, so the shape of each field survives — you can still see that there is a token on the line and roughly where — but the secret itself is gone. Enable Partial keep prefix and the first few characters of each value remain visible for quick manual triage, which is often the sweet spot for debugging while still protecting the bulk of the secret.

Each of the eight built-in categories runs independently and can be toggled off if it does not apply to your data, and the summary cards report exactly how many of each type were found and masked so you know the pattern actually did something rather than silently matching nothing. The IPv4 and IPv6 address patterns are tuned to avoid firing on plain HH:MM:SS clock readings that happen to share a colon-separated shape with a shortened IPv6 address, so turning IP masking on will not chew through every timestamp in a bracketed or space-separated log format. Custom regular expressions, one per line, extend coverage to anything the built-ins do not anticipate — internal request IDs, vendor-specific key formats, or a connection string shape unique to your stack.

Masking is deliberately local and deterministic: the same input with the same options produces the same output, every time. Nothing is uploaded, nothing is guessed, and nothing is removed except the exact values the patterns identify. The result is a log that is safe to share and still legible to the humans and systems that need it.

• IP masking — IPv4 and IPv6 addresses.
• Email masking — full email addresses.
• Token masking — bearer and Authorization headers.
• Password masking — password=, pass=, pwd= and similar keyed values.
• API key & JWT masking — common formats including base64 JSON web tokens.
• AWS key masking — AKIA/ASIA access key IDs.
• Card & SSN style numbers — optional numeric patterns.
• Custom regex patterns — one expression per line for anything bespoke.
• Partial keep prefix — retain the start of each value for triage.
• Match statistics — how many of each type were masked.
• Copy / Download / Print — take the masked log with you.
• 100% local — nothing leaves the browser.

1. Paste your log. Drop any log text into the box.
2. Choose patterns. Tick the data types you want masked — IPs, emails, tokens, passwords, API keys, JWTs, AWS keys, cards — or leave them all on.
3. Add custom patterns if needed, one regex per line in the Custom patterns box.
4. Pick a mask style. Use the fixed mask or enable Partial keep prefix to retain the start of each value.
5. Run. The summary cards show how many values of each type were masked.
6. Review and share. The output preview is safe to copy or download.

Example 1 — A ticket with tokens. An auth service log line: POST /api/1/login 401 - Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc.xyz ip=203.0.113.5. After masking, the JWT and the IP become masks and the line is safe to paste into a support ticket.

Example 2 — A connection string. jdbc:postgresql://db:5432/app?user=admin&password=sup3rsecret — the password= pattern (plus the custom regex option) masks the credential while the host stays readable.

Example 3 — Customer emails. GDPR-friendly masking of user=jane.doe@example.com turns the address into a mask, so a log exported for analysis no longer contains personal data.

Example 4 — Debug triage. With Partial keep prefix on, Bearer eyJhbGci...secret keeps its first few characters so you can still tell tokens apart at a glance.

• Share logs safely — no secrets in tickets, chats, or forums.
• Compliance-ready output for GDPR/PCI-style reviews.
• Legible after masking — structure is preserved.
• Broad built-in coverage plus custom regexes.
• Private — all processing stays local.