Sensitive Data Masker

A screenshot of your .env is a screenshot of your infrastructure. The Sensitive Data Masker turns that risk into a share-safe copy: sensitive values are replaced with masks that keep the file readable without leaking the secret.

It works on three levels. First, keys whose names imply secrets are masked automatically. Second, you can add your own keys to a custom mask list. Third, a “mask all values” toggle blanks everything for maximum safety. The output is a plain-text file you can paste into a ticket, a chat, or an issue without a second thought.

Everything runs in the browser; the original file never leaves your machine.

• Auto-masking: KEY, SECRET, TOKEN, PASSWORD names.
• Custom list: add keys to mask manually.
• Mask-all toggle: blank every value.
• Partial visibility: first/last 4 chars kept.
• Structure preserved: comments and keys intact.
• Masked-only output: safe to share.
• Copy or download: export the redacted file.
• Private & free: 100% in-browser.

1. Paste your .env into the input, or load the sample.
2. Add custom keys to the mask list (one per line) if needed.
3. Toggle mask-all if you want every value hidden.
4. Click Mask. The redacted file appears — copy or download it.

Example 1 — Debugging with a teammate. A developer needs help with a parsing bug and shares the masked .env in a private channel — keys stay readable, values stay safe.

Example 2 — Ticket reproduction. A support ticket asks for config; the masked file proves the setup without exposing the Stripe key.

Example 3 — Screenshot for docs. A config panel screenshot for internal docs uses mask-all so even the app name is blurred out.

Example 4 — Public template. A team publishes their .env structure as a sample; the masker hides their real session secret automatically.

Example 5 — Hiring exercise. A take-home config is scrubbed with the masker before being shared with candidates.

• Share with confidence: no more manual find-and-replace.
• Three coverage levels: auto, custom, or all.
• Structure intact: still looks like real config.
• Deterministic: same file, same output.
• Private: nothing uploaded.
• Free: unlimited redactions.