Redact personal data and secrets from text

Paste a log, an email or a config file. Emails, phone numbers, card and ID numbers, API keys and passwords are found and replaced in a copy you can share. The text never leaves this tab.

  • Free, no sign-up
  • Never uploaded
  • Nothing stored

Text redactor

Emails, cards, keys and passwords, out of any text

Paste a log, an email or a config file

Or drop a .txt, .log, .csv or .json file anywhere on this window. Nothing is uploaded.

  • Personal data
  • National IDs
  • Finance
  • Secrets & keys
  • Network
  • Your keywords

Stays on your device.

Updated October 2026

Quick answer

To redact text, replace every sensitive value with a placeholder in a copy, then share only the copy. This tool finds values with a fixed shape (emails, phone numbers, card numbers, IBANs, national ID numbers such as a DNI, CPF or PESEL, IP addresses, API keys, tokens and passwords in config) and replaces them in your browser. Names and street addresses have no fixed shape, so add those as keywords, and read the result once before you send it.

On a live web page

Redact it on screen, before you share it

When the secrets are on a web page you are about to screen share, a dashboard, an admin panel or a terminal in the browser, Blurr.ing blurs them in place. Blur Text matches your own keywords and 34 ready-made presets (emails, card numbers, API keys, IPs and more) on every page you open, so they are blurred before anyone sees them. Drawing blurs by hand is free and unlimited; the free plan keeps one Blur Text rule or preset, and Premium unlocks the rest.

  • Draw a box, select text or click an element. Free and unlimited.
  • Screenshots come out with the blurs already in the picture. 5 free, unlimited on Premium.
  • Auto Blur, Blur Text and Tab Privacy hide things for you on every page. Try each one free.
Add to Chrome

Free to install, for Chrome on a computer.

How it works

How to redact text online

  1. 1

    Paste your text

    Paste a log, an email thread, a config file or a support ticket, or drop a .txt, .log, .csv or .json file onto the box.

  2. 2

    Check what it found

    Matches are counted per type and highlighted in the redacted copy. Switch off any type you want to keep, such as IP addresses in a network log.

  3. 3

    Add your own keywords

    Type names, company names or project codenames the patterns cannot guess. A /regular expression/ works too.

  4. 4

    Copy or download

    Pick labels, equal-length blocks or consistent pseudonyms, read the result once, then copy it or download it as a .txt file.

What it finds

Every type it detects, and how

Each type can be switched off in the tool. Where a checksum exists, a candidate has to pass it. The two ID numbers that have none, Vietnam’s CCCD and Indonesia’s NIK, need a real region code and birth date instead.

TypeExampleHow it is matched
Email addresses [email protected] Any address with a domain.
Phone numbers +1 (415) 555-0132 International or grouped numbers, 9 to 15 digits. Dates, versions and long plain ids are skipped.
Card numbers 4242 4242 4242 4242 13 to 19 digits that pass the Luhn checksum.
IBANs GB29 NWBK 6016 1331 9268 19 Must pass the IBAN mod-97 check.
Polish account numbers (NRB) 61 1090 1014 0000 0712 1981 2874 26 digits without the PL prefix, checked like an IBAN.
US SSNs 123-45-6789 Dashed form only, invalid ranges skipped.
IP addresses 192.168.1.24 · 2001:db8::1 IPv4 with valid octets, and IPv6.
API keys & tokens sk_live_… · ghp_… · AKIA… Known formats: AWS, Stripe, GitHub, OpenAI, Anthropic, Slack, Google and more.
JWTs eyJhbGciOi… Three base64url parts starting with eyJ.
Private keys -----BEGIN PRIVATE KEY----- Whole PEM and OpenSSH key blocks.
Passwords & secrets in config password=hunter2 The value after password, secret, token, api_key and similar names, plus Bearer and Basic auth headers.
Credentials in URLs postgres://user:pass@host · ?token=… user:password@ in a URL and secret-looking query parameters.
Crypto wallets 0x8f2c… · bc1q… Ethereum-style 0x addresses and Bitcoin bech32 and legacy addresses.
Spanish DNI 12345678Z 8 digits and a letter that must match the mod-23 check.
Spanish NIE X1234567L X, Y or Z, 7 digits and a check letter.
Mexican CURP GAPA850312HDFRRN00 18 characters with a real birth date, state code and check digit.
Mexican RFC GAPA850312K45 12 or 13 characters with a real date. Capital letters only.
Brazilian CPF 111.444.777-35 000.000.000-00 or 11 digits, with both check digits.
French NIR 1 85 05 78 006 084 91 Social security number: 15 digits with the 2-digit key, Corsica 2A and 2B included.
Italian codice fiscale RSSMRA85T10A562S 16 characters whose last letter must match the check.
German Steuer-ID 86095742719 11 digits with the ISO 7064 check digit and the digit-repeat rule.
Dutch BSN BSN 123456782 9 digits passing the elfproef, only right after BSN or burgerservicenummer.
Polish PESEL 85031207659 11 digits with a real birth date and check digit.
Polish NIP 123-456-32-18 Tax number with its check digit, dashed or after PL. Plain 10 digits only after NIP.
Polish REGON REGON 123456785 14 digits with both check digits. 9 digits only after REGON.
Russian SNILS 112-233-445 95 11 digits, often 000-000-000 00, with a valid checksum.
Russian INN ИНН 7707083893 12 digits with both check digits. The 10-digit company INN only after ИНН or INN.
Turkish T.C. Kimlik No 10000000146 11 digits, not starting with 0, with both check digits.
Vietnamese CCCD 001090012345 12 digits. No check digit exists, so the province code, century digit and birth year must be real.
Indonesian NIK 3171014509900001 16 digits. No check digit exists, so the region code and birth date (women add 40 to the day) must be real.
Your keywords Acme Corp, Jane Doe Names, companies, project codenames: anything regex cannot guess.

Names and addresses

A person’s name or a street address has no fixed shape, so patterns cannot find them reliably. Add them as keywords.

Unknown key formats

Known vendors are matched by prefix, and secrets after names like password= or token= are caught. A random string with no label and no prefix is not.

Read it before you share

Treat the result as a first pass. A quick read of the redacted copy is what catches the one value that slipped through.

Why there is no upload

A redaction tool should not see your secrets

Pasting a production log into a website that processes it on a server is how keys end up in somebody else's logs. This page does all of its work in your browser.

No upload, ever

The text is processed by JavaScript in this tab. The page sends nothing anywhere, and keeps working offline once it has loaded.

Nothing is stored

There is no account, history or saved draft. Close the tab and the text is gone.

Checksums, not guesses

Card numbers must pass the Luhn check, IBANs the mod-97 check and ID numbers their own check digits, so order ids and timestamps are left alone.

Keep exploring

More ways to keep secrets out of what you share

Redact an image

The same idea for screenshots: black out, blur or pixelate any part of an image, in your browser.

Hide API keys on a screen share

Blur keys, tokens and customer records on the live page before you demo, pair or file a bug.

How to redact a screenshot

Which masks hold up, which leak, and why a solid box beats a blur for text.

FAQ

Redacting text, answered

How do I redact personal information from text?
Paste the text into the tool above. It finds emails, phone numbers, card numbers, IBANs, national ID numbers, US Social Security numbers, IP addresses, API keys, JWTs, private keys, passwords in config and crypto wallets, and replaces each one in a copy. Add names and company names as keywords, read the result, then copy or download it.
Which national ID numbers does it detect?
Spain’s DNI and NIE, Mexico’s CURP and RFC, Brazil’s CPF, France’s NIR (the social security number), Italy’s codice fiscale, Germany’s Steuer-ID, the Dutch BSN, Poland’s PESEL, NIP and REGON, Russia’s SNILS and INN, Turkey’s T.C. Kimlik No, Vietnam’s CCCD and Indonesia’s NIK, plus Polish account numbers written without PL. Each has to pass its own check digit, so a random run of digits is left alone; CCCD and NIK have no check digit, so their region code and birth date must be real. The BSN, a 10-digit INN, a plain 10-digit NIP and a 9-digit REGON are only matched right after their name, because their checks pass too many random numbers. Any other ID format can go into the keywords as a /regular expression/.
Is it safe to paste secrets into an online redaction tool?
Only if the tool never sends the text anywhere. This one runs entirely in your browser: there is no upload, no account and no storage, and it keeps working with the network switched off after the page loads. If a secret has already been shared somewhere, redacting it later does not help: rotate it.
Can it redact API keys and passwords from logs?
Yes. It recognises keys from AWS, Stripe, GitHub, GitLab, OpenAI, Anthropic, Slack, Google, SendGrid, npm, Hugging Face and others by their prefix, plus JWTs, PEM private keys, Bearer and Basic auth headers, passwords inside connection strings, secret query parameters, and the value after names like password=, secret=, token= or api_key=.
Does it detect names and street addresses?
No, not reliably, and no pattern-based tool can: names and addresses have no fixed format. Type them into the keywords field and every occurrence is redacted, matched as whole words and regardless of case.
What is the pseudonym option for?
It replaces each distinct value with a numbered placeholder such as EMAIL_1 or IP_2, and the same value always gets the same placeholder. That keeps a log readable: you can still follow one user or one host through it without seeing who or what it is.
Is this text redaction tool free?
Yes: no sign-up, no limits and no watermark. It is made by Blurr.ing, a Chrome extension that blurs sensitive data on live web pages before you screen share or take a screenshot.

Blur it before you share it.

Free on the Chrome Web Store. Works on any site, no account needed.

Add to Chrome