Text Redaction Tool – Strip Sensitive Data Before You Share
Almost every request for help starts with a paste. You copy a stack trace into a public bug report, drop a customer email into a group chat, or attach a log to a vendor ticket — and somewhere in those lines sits an address, a card number, an internal hostname or an API key. Deleting each one by hand is slow, and one missed value undoes the whole effort. This text redaction tool does the sweep for you: it finds sensitive values, shows you exactly what it found, and replaces only what you approve.
What the detectors look for
Fourteen built-in detectors cover the values that leak most often: email addresses, phone numbers, URLs, IPv4 and IPv6 addresses, MAC addresses, credit card numbers, US Social Security numbers, IBANs, dates, postal and ZIP codes, API keys and tokens, UUIDs, and a heuristic matcher for person names. Each one is a regular expression tuned for the shape of the value — an email is a local part, an @, a domain and a suffix of at least two letters, while an AWS access key is AKIA or ASIA followed by sixteen upper-case characters.
Checksums keep the false positives down
Shape alone is not enough. A sixteen-digit order reference looks exactly like a card number, so card candidates must also pass the Luhn checksum: double every second digit from the right, subtract nine from anything above nine, and the total has to be divisible by ten. IBANs go through the ISO 13616 mod-97 test — move the first four characters to the end, turn letters into numbers, and the remainder must be 1. IPv4 candidates are rejected unless every octet is 255 or lower, and SSN candidates with a 000, 666 or 9xx area group are dropped because those groups are never issued.
Merging, ordering and safe replacement
Detectors overlap constantly. A URL with an email in its query string matches two patterns over the same characters, and splicing both in would produce corrupted output. Matches are therefore sorted by offset and merged, with the higher-priority detector winning — secrets beat IBANs, IBANs beat cards, cards beat phone numbers, and everything beats the postal-code and name heuristics. Replacement then walks the list right to left so that every offset still points at the right characters when its turn comes.
Choosing a redaction style
Block and character mask substitute one mask character per original character, which keeps CSV columns and log alignment intact. Label drops in a single string such as [REDACTED]. Category label writes [EMAIL] or [CARD], so a reader knows what kind of value was removed without seeing it. Partial mask keeps a few leading or trailing characters — the •••• •••• •••• 4242 convention — so the owner still recognises their own value. Pseudonym assigns a stable placeholder per distinct value, which is the only style that keeps a document analysable: if EMAIL_1 appears three times, you still know it was the same person. Remove deletes the value outright.
Custom terms and your own patterns
Built-in detectors cannot know your internal vocabulary. The custom term list takes any names, company names, project codenames or hostnames, escapes them so punctuation is treated literally, and matches them with optional word boundaries and case sensitivity — so art does not quietly redact the middle of start. For structured identifiers, the custom regex field accepts a full JavaScript pattern such as \bEMP-\d{6}\b, with live feedback on whether it compiles and a guard that rejects patterns matching the empty string.
Review before you trust the output
Nothing is destroyed silently. Every match appears in a table with its category, its offset and its replacement, and a switch to exclude it — because a version number that resembles an IP address or a build ID that resembles a token should survive. Excluded matches are counted in a residual risk notice so you never lose track of what you deliberately kept. A statistics panel reports how many characters were replaced, how many distinct values were found, and how the matches split across categories.
Redaction is not black boxes on a PDF
The most common redaction failure is visual rather than textual: a black rectangle drawn over a PDF or an image leaves the original text in the file underneath, recoverable by anyone who selects and copies it. Replacing characters in the source text, as this tool does, removes the data itself. Everything runs locally in your browser — the document is never uploaded, and the share link carries your settings profile only.