Terraform Output Masking Tool

The Terraform Output Masking Tool takes raw Terraform plan or apply output and masks every assigned value, so you can paste logs into issues, chat threads, or tickets without leaking data. Structure and resource addresses are preserved, which keeps the output readable for debugging while removing the secrets. Many teams need to share plan output to get help, but plan and apply logs often contain bucket names, instance ids, IP addresses, connection strings, and other information that should stay private. Masking every value after an equals sign hides strings, numbers, and booleans, replacing them with a clear placeholder. The tool runs entirely in your browser, so the text you paste never leaves your machine and no cloud or Terraform Cloud connection is made. It is a fast, safe step to take before you share any terraform output with colleagues or in a public issue. When you mask a whole run you also avoid the slow, error prone game of deciding which single line is secret, because every value is treated the same way. Reviewers still see the resource types, the planned actions such as create or destroy, and the block layout, so they can reason about the change while only the actual data is hidden. Used as a habit before pasting into Slack or GitHub, it removes a common cause of accidental credential leaks, and it works on apply output as well as plans so a failed apply log can be shared safely too.

• Mask all values - strings, numbers and booleans after = are replaced with a placeholder.
• Keep structure - resource types, names and layout stay readable for debugging.
• Preserve addresses - resource addresses such as aws_s3_bucket.this are never masked.
• Local only - processing happens in the browser; nothing is uploaded.
• Copy, download, print - export the masked result wherever you need it.
• Stats row - shows how many values were masked in the run.
• Markdown export - copy a fenced markdown block for chat or docs.
• One click - paste and mask with a single button press.
• Stable output - the same input always masks the same way for repeatable reports.
• Privacy first - good practice before posting any log publicly.
• Whole-run mask - masks every value so you never have to pick which line is sensitive.
• Preserves actions - create, update, and destroy markers stay visible for review.
• Apply logs too - masks apply output, not only plans, for safe failure reports.

1. Open the tool and locate the plan or apply output box on the left.
2. Paste your output from a terraform plan or terraform apply run, including the resource blocks you want to share.
3. Click Mask output to replace every assigned value with the placeholder.
4. Review the preview on the right to confirm the structure is intact and values are hidden.
5. Check the stats row to see how many values were masked in this run.
6. Export the result with Copy, Copy as Markdown, Download, or Print before posting it.
7. Re-run after edits whenever you change the pasted text so the preview stays current.
8. Trust but check - glance at the masked text to confirm no value slipped through, then share it.
9. Use the sample to see a realistic plan masked in one click before trying your own.

Example 1 - string value. The line bucket = "my-secret-bucket" becomes bucket = "***MASKED***" while the resource label is unchanged.

Example 2 - boolean value. enabled = true becomes enabled = ***MASKED*** so flags are hidden too.

Example 3 - address kept. resource "aws_s3_bucket" "this" is left exactly as written because labels are not values.

Example 4 - number. A port such as port = 443 is masked like any other assigned value.

Example 5 - list value. A list such as tags = ["a", "b"] has each quoted element masked so nothing in the list is revealed.

Example 6 - unchanged line. A line with no equals sign, such as a comment or a plan summary, is left exactly as written.

• Safe logs - share plans without leaking data or secrets.
• Quick - one click masks a whole run.
• Local - no uploads, fully private.
• Readable - structure stays so others can still help.
• Portable - copy, markdown, download, or print.
• Auditable - the masked report is safe to attach to a public issue.
• Habit forming - a quick step that prevents accidental leaks.
• Collaboration safe - others can still help debug from the structure.
• No setup - no config or account needed to start masking.