String Masking
Mask sensitive strings by keeping a few characters at each end, or auto-detect and hide secrets like API keys, tokens and card numbers, in your browser.
String Masking — Paste any text and redact the sensitive parts without it ever leaving your machine. Manual mode keeps the first and last few characters of each line and replaces the middle with a mask character, perfect for partially hiding emails, phone numbers, IDs or account numbers. Auto-detect mode scans the text for common secrets — API keys, JWTs, email addresses, credit card numbers, phone numbers and IPv4 addresses — and masks each match while leaving enough context to recognize it. Everything runs locally with plain JavaScript and regular expressions, so nothing is uploaded. You can turn individual categories on or off, add your own regular-expression pattern, keep card detection accurate with a Luhn checksum, and set a multi-character mask string — all from the settings panel.
What is String Masking?
String Masking is a free in-browser redaction tool that turns sensitive text into a safely shareable form. It offers two modes you switch between with a toggle: Manual masking keeps a set number of leading and trailing characters (the Keep start and Keep end fields) and stars out the middle of every line, while Auto-detect scans free text and masks API keys, JWT tokens, emails, credit card numbers, phone numbers and IPv4 addresses on its own. Developers, support and QA staff, and privacy-minded writers use it to scrub logs, screenshots-to-text, bug reports, and chat transcripts before pasting them into tickets, docs or AI prompts. You can change the mask character in settings, the output updates live as you type, and a counter shows how many secrets were detected. Because it is pure regular-expression processing, it is fast, deterministic and fully offline. It also detects US Social Security numbers, IBANs and passport/ID numbers, and in settings you can toggle each category, supply a custom regular-expression pattern, require a Luhn checksum for cards, and choose a multi-character mask string.
How to use String Masking
- Choose a mode: Manual masking to keep set characters at each end, or Auto-detect to find and mask secrets automatically.
- For Manual mode, set Keep start and Keep end to the number of characters you want to leave visible at the front and back of each line.
- Paste or type the text you want to redact into the Input box; each line is masked independently.
- Read the redacted result in the Output box, which updates instantly as you type.
- Open settings to choose which categories to mask, add a custom regular-expression pattern, toggle the Luhn card check, or set a multi-character mask string; then copy the masked output with the copy button.
Examples
Partially masking an email (Manual, keep 2 / 2)
Input
alice@example.com
Output
al*************om
Auto-detecting secrets in a log line
Input
user bob@acme.io ssn 123-45-6789 card 4242 4242 4242 4242 token sk_live_AbCdEf123456
Output
user b***@acme.io ssn ***-**-6789 card **** 4242 token ********
Masking many IDs at once
Paste one value per line in Manual mode; every line is masked separately, so you can redact a whole column of account numbers or order IDs in a single pass.
Frequently asked questions
- Is my text uploaded anywhere?
- No. All masking runs 100% client-side in your browser with plain JavaScript and regular expressions. Your input is never sent to or stored on any server, so it is safe for logs, secrets and personal data, and it keeps working offline.
- What is the difference between Manual and Auto-detect modes?
- Manual masking keeps the number of leading and trailing characters you choose and stars out the middle of each line, which is ideal when you know the exact format. Auto-detect scans free text and masks recognized secrets — API keys, JWTs, emails, credit card numbers, phone numbers and IPv4 addresses — without you specifying positions.
- Which kinds of secrets can Auto-detect find?
- It looks for common patterns: email addresses, credit card numbers (13-19 digits), phone numbers, IPv4 addresses, JWT tokens, and API-key prefixes such as Stripe (sk_/pk_), GitHub (ghp_, gho_…), Slack (xox…) and AWS access keys (AKIA…). Detection is pattern-based, so unusual formats may be missed — always review the output. It also recognizes US Social Security numbers (123-45-6789), IBANs and letter-prefixed passport/ID numbers, and you can enable or disable each category in settings.
- Can I customize what gets masked and how?
- Yes. In settings you can turn each detector category on or off, add your own regular-expression pattern, require a Luhn checksum so only valid card numbers are masked, and set a multi-character mask string (for example *, ••, XX or #). The mask repeats to fill, and it applies to both modes.
- Does it handle multiple lines and Unicode?
- Yes. In Manual mode each line is masked independently, so you can redact a whole list at once. Masking works on Unicode code points, so emojis and accented characters are not split.
Related tools
AES Text Encryption (AES-GCM + PBKDF2)
Encrypt and decrypt text with AES-256-GCM using a passphrase-derived key (PBKDF2 SHA-256, random salt), entirely in your browser with no uploads.
Argon2 & scrypt Hash
Hash a password with Argon2id or scrypt and verify an Argon2 hash against a password, entirely in your browser.
Bcrypt Hash Generator & Verifier
Generate a bcrypt password hash from plain text at a chosen cost factor, or verify a password against an existing bcrypt hash, entirely in your browser.
BIP39 Mnemonic Generator
Generate a random BIP39 recovery phrase of 12 to 24 words in several languages, or convert an existing mnemonic back into its raw entropy, entirely in your browser.