Prompt Secret Scrubber

What the Prompt Secret Scrubber Detects

The scrubber ships a deterministic ruleset modelled on gitleaks and Trufflehog. Every rule runs entirely in your browser — there is no AI model download, no telemetry, and no network call. Each detected secret is replaced with a stable [REDACTED_KIND_N] placeholder so you can paste a clean prompt into any LLM tool while still being able to eyeball what was matched.

How to Use the Prompt Secret Scrubber

1. Paste the prompt, log snippet, stack trace, .env file, terraform output, or diff into the input area.
2. Click Scrub secrets. The deterministic regex pass runs in a single browser tick.
3. Review the findings table — each detected secret shows up with its placeholder, its kind, and a short masked preview (first 4 / last 4 characters).
4. Click Copy scrubbed text and paste the result into ChatGPT, Claude, Gemini, or any other AI assistant.
5. Click Reset when you are done. The input is cleared and nothing about the secret values persists.
6. If any secret had been leaked before scrubbing (chat logs, emails, LLM history), open the provider's dashboard and rotate it.

Key Features

• Deterministic regex pass — no AI model, no statistical guesswork. Either a string matches a known token format or it does not.
• 20+ provider rules — AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Discord, Twilio, SendGrid, Mailgun, npm, plus JWTs and PEM private keys.
• Stable placeholders — every secret becomes [REDACTED_KIND_N], so multiple references to the same secret get an identifiable label without revealing the underlying value.
• Findings preview only — the table shows just the first 4 and last 4 characters of each match so you can verify the scrubber caught what you expected. The full secret is never stored or transmitted.
• Zero network call — no model download, no telemetry, no analytics. Works offline once the page is loaded.
• 20,000-character limit — enough for most .env files, stack traces, diffs, and prompts.

When to Use the Prompt Secret Scrubber

• Debugging with ChatGPT or Claude — paste a stack trace or log snippet without dragging your AWS keys, JWT bearer tokens, or DB connection strings along.
• Reviewing terraform output — strip access keys, service-account blobs, and connection strings before asking an AI to summarise infrastructure state.
• Cleaning a .env paste — let an AI lint or refactor environment files without leaking the values.
• Sharing CI / pipeline output — bearer tokens, OAuth tokens, and webhook URLs are common in job logs; scrub them before asking an AI for help.
• Documentation drafting — paste a README with example credentials and the scrubber redacts them before you ask an AI to polish the prose.
• Compliance reviews (SOC 2, ISO 27001) — provides a documentable in-browser path for staff who need to use external LLMs with internal artefacts.

Why a Regex Pass Is Enough for Most Secrets

Most cloud providers issue credentials with a fixed, recognisable prefix and length: AWS access keys start with AKIA / ASIA, OpenAI keys with sk-, GitHub tokens with ghp_, Stripe live keys with sk_live_, and so on. That makes regex extraordinarily effective for the high-value 90% of secret types — exactly the same approach used by gitleaks, Trufflehog, and GitHub's own push-protection. The trade-off is that the scrubber will not catch bespoke company-internal tokens that follow no public format, so always skim the scrubbed text before pasting.

How This Pairs With Our Other Privacy Tools

• PII Masker for AI Prompts — handles personal identifiers (names, emails, phones, SSNs, credit cards) and supports restoring the AI's reply back to real values. Run it after the Secret Scrubber for the strongest coverage.
• Document PII Redactor (coming soon) — full .txt / .md / .docx / .pdf redaction with the same fully-local stack.
• Private Document Q&A (coming soon) — on-device RAG so you can ask questions over an internal document without uploading it.

What This Tool Cannot Do

• Un-leak a secret. If a token has already entered an LLM provider's chat history, rotate it. The scrubber prevents the next leak.
• Match every custom token. Internal company tokens with no public format will pass through. Skim the scrubbed output.
• Replace a real secret scanner in CI. Use gitleaks or Trufflehog in your build pipeline. This page is for the prompt layer — the last mile before a value reaches ChatGPT.