Password Mask and Secret Redaction
Mask a password for display (keep first/last characters, fixed length) or redact passwords, tokens and URL credentials in logs and config text.
0 = same length as the password; otherwise the real length is hidden.
Use Show/Hide to unmask what you typed. Masking only hides characters for display: to hide the length too, set a fixed mask length.
Runs entirely in your browser. Your data is never uploaded.
What is Password Mask/Unmask Tool?
Two tools in one: mask a single password for display, for example Co**42, and redact passwords, API keys, tokens and URL credentials inside a block of text such as logs or configuration files before you share it. The Show/Hide button unmasks what you typed.
How to use Password Mask/Unmask Tool
- Choose the Mode: mask a password, or redact passwords in text.
- Set Keep first characters, Keep last characters, the Mask character and an optional Fixed mask length.
- Type the password, or paste the text to redact.
- Copy the masked or redacted result.
Example
DATABASE_URL=postgres://app:S3cr3t!@db:5432/prod
DATABASE_URL=postgres://app:*******@db:5432/prod
When to use Password Mask/Unmask Tool
Use it before pasting logs, stack traces or configs into tickets, chats or AI tools, and to show a hint of a stored password in a UI. Always review the redacted text; unusual formats may be missed.
How Password Mask/Unmask Tool works
Masking keeps the chosen number of leading and trailing characters (by Unicode code point) and replaces the rest with the mask character, or with a fixed number of mask characters to hide the length. Redaction applies three patterns: scheme://user:secret@host URLs, key=value / key: value pairs and JSON "key": "value" fields whose key contains password, passwd, pwd, secret, token, api_key, access_key, private_key, client_secret or auth. Matched values are replaced with mask characters; the number of replacements is shown.
Common Use Cases
- Redacting a database URL before posting it in a support ticket
- Cleaning .env files before sharing them
- Showing a masked API key in an admin interface
- Preparing log excerpts for bug reports
Security Note
Redaction happens in your browser; the text is not uploaded.
FAQs
Can a masked password be unmasked?
No. The hidden characters are not in the output. 'Unmask' refers to the Show button for the text you typed.
Why use a fixed mask length?
A mask with the real length reveals how long the password is; a fixed length hides it.
Does redaction catch every secret?
It catches common key names and URL credentials. Secrets with unusual names or inside free text may remain, so review the output.