pastesiteRedact a log before you share it
A log is the most useful thing to paste and the easiest way to leak a credential. This tool replaces the identifying parts — email addresses, IP addresses, tokens and keys, and the usernames inside home directories — with numbered placeholders, so the failure still reads and the secret does not travel. Every pattern runs in this tab.
Nothing redacted yet.
The log never leaves this tab. The patterns run in JavaScript on this device, the text is not stored, and the only thing sent anywhere is what you paste into the editor yourself.
What gets redacted, and what stays?
Four categories, each replaced with a numbered label. A value that appears twice keeps one number, so the reader can still follow a request through the log without learning who it belonged to.
| Category | What it catches | Becomes |
|---|---|---|
| Tokens and keys | GitHub, Slack, Stripe-style keys, AWS key IDs, JWTs, bearer tokens, private key blocks, and the values after password=, token: or --password | [redacted:token-1] |
| Email addresses | Any address, including ones inside a query string or a quoted header | [redacted:email-1] |
| IP addresses | IPv4, and IPv6 only when it is shaped like an address rather than a time | [redacted:ip-1] |
| Usernames in paths | /Users/…, /home/… and C:\Users\…, keeping the rest of the path | [redacted:user-1] |
What stays is everything that makes the log worth reading: timestamps, levels, request IDs, stack frames, SQL and the error text. A redacted stack trace should still point at the line that failed.
Why does a log leak more than the error?
Credentials rarely appear as a field called password. They arrive as a query string, an Authorization header echoed by a proxy, a connection URL with the password inside it, or a token pasted into a curl command that failed. The same is true of identities: a home directory names a person, and an email in a log line is a real address in a shared file.
Redaction is not a guarantee. A token can be split across lines, encoded, or spelled in a way none of these patterns expect, and a redacted log can still contain personal data in a free-text message. Read the output before you send it.
After redacting: share it
Press Open in the editor and the redacted text is waiting there, unsubmitted. Set the language to Logs so the levels and timestamps are coloured, choose an expiry for a one-off investigation, and keep the paste unlisted if it names internal hosts or customers.
Frequently asked questions
Is my log uploaded when I redact it?
No. The patterns run in JavaScript in this tab, and nothing is sent anywhere. The text reaches the server only if you press Open in the editor and then create the paste.
Does it find every secret?
No. It recognises common shapes — provider keys, JWTs, bearer tokens, passwords in key/value pairs and flags — plus emails, IP addresses and usernames in paths. A secret that is split, encoded or defined by your own systems can get through, so read the result.
Why do repeated values keep the same number?
So the log still reads. If one host appears five times as [redacted:ip-1], you can follow the request; five different numbers would hide that they were the same host.
Is the redacted text stored in the browser?
Only when you press Open in the editor: the redacted text is held once in the tab’s session storage, read by the editor and removed immediately. A reload does not bring it back.