Terraform Sensitive Value Redactor

The Sensitive Value Redactor scrubs secrets from Terraform output and state before you share them with teammates, paste them into tickets, or attach them to support cases. It targets the secret keys that Terraform and cloud providers commonly emit, such as passwords, tokens, API keys, private keys, credentials and client secrets, and for plan JSON it additionally honours the after_sensitive markers that Terraform itself records. Because the work happens entirely in your browser, the original data is never uploaded and never leaves your machine, so you can safely redact even production-shaped configurations. The tool handles both structured JSON, which it parses and walks recursively, and free-form text output, where it redacts assignment values whose key looks sensitive. The result is clean, shareable text that still preserves structure and context, making it ideal for bug reports, documentation and knowledge-base articles. It also helps teams build a safe habit: redact first, then share, so a careless paste never costs you a credential rotation. The redactor is deliberately simple to use and easy to trust, which means people actually reach for it instead of sharing raw logs. It is not a substitute for a proper secrets manager, but it is the fastest way to avoid accidentally leaking a credential in a screenshot, a chat message, or a public issue tracker.

• JSON aware - parses plan and state JSON and redacts values whose keys match sensitive patterns.
• Text aware - redacts the assignment value for any line whose key looks sensitive in raw output.
• after_sensitive - honours Terraform sensitivity markers so plan-time secrets are removed.
• Recursive walk - descends into nested objects and arrays to catch deeply buried secrets.
• Broad key list - matches password, passwd, secret, token, apikey, access_key, private, credential, client_secret, auth and more.
• Private - all processing happens locally with no uploads.
• Redaction stats - a live stats row reports how many values were redacted and how many lines resulted.
• Word-wrap toggle - switch the preview between scroll and wrap for easy reading.
• Copy / Download / Print - export the cleaned output in the format you need.
• CI friendly - the redacted text can be pasted straight into logs, tickets and chat without risk.
• Deterministic - the same input always produces the same redacted output, so reviews stay reproducible.

1. Choose the format - decide whether your paste is structured JSON or free-form text output, because each is handled differently.
2. Paste your text - drop in plan or apply text output, or a plan / state JSON, into the input box.
3. Load the sample if you want to see a realistic JSON containing a password and an after_sensitive marker.
4. Click Redact to scrub every detected secret from the input.
5. Review the output in the preview pane and confirm no real secret remains.
6. Check the stats row to see how many values were redacted and how many lines were produced.
7. Toggle word wrap if long JSON lines are hard to read on a narrow screen.
8. Export the result by copying it, downloading a text file, or printing it for a ticket.
9. Stay cautious - always eyeball the result, because redaction is heuristic and may miss unusual key names.

Example 1 - JSON password. A plan JSON with password = "hunter2" and an after_sensitive flag becomes password = "***REDACTED***" while the harmless username and engine fields are kept. The stats row then shows one redaction.

Example 2 - text output. A raw line such as aws_secret_access_key = "abc123" is trimmed to aws_secret_access_key = ***REDACTED***, so the key never reaches a paste buffer or a screenshot.

Example 3 - private key. A pem block assigned to a private_key attribute is replaced wholesale, because even a single exposed key is enough to compromise an environment.

• Safe sharing - remove secrets before pasting into tickets, chats or docs.
• Speed - no manual scrubbing or risky find-and-replace.
• Local - nothing leaves the browser, so production data stays private.
• Auditable - the stats row gives a quick count of what was removed.
• Peace of mind - a fast guardrail against accidental credential leaks.
• Repeatable - the same simple step works on every plan, apply log and state export you generate.
• Compliance - redacting before sharing helps satisfy data-handling rules that forbid sending secrets through third-party tools.