# Redact Secrets > Paste a payload, a .env file, a config blob or a cURL command. Every recognised credential is found, masked and taken out before you share it. Free, no account needed. Redact Secrets finds hardcoded API keys, tokens and private keys in text or JSON you paste, and gives you back the same text with every secret redacted — running entirely in your browser. Also: redact secrets, remove api keys from a file, redact api keys, strip credentials before sharing, sanitise env file, mask tokens in a log, find hardcoded secrets, api key detector, clean a config file of secrets. ## What it does Credentials leak by being committed, pasted into a ticket, or shared in a config file nobody re-read. This finds them before that happens. Paste a config file, an environment export, a request payload, a .env file or a log line, and every recognised credential is listed with its type and its exact location. You also get the same content back with every secret redacted, so it is safe to paste into a ticket, a pull request or a chat. The detection runs on a WebAssembly engine inside the page, so nothing you paste is uploaded anywhere. ## When to use it - You are about to commit a config file and want to know whether a key is still in it. - You need to paste a request payload into a bug report and want the credentials stripped first. - You inherited a .env file and want to know which of its values are real credentials. - You want to check a log excerpt for tokens before sharing it with support. - You are reviewing a pull request and want a second pair of eyes on a payload. ## What you give it | Input | Meaning | | --- | --- | | Text or JSON | Anything you can paste: a JSON payload, a config or .env file, a cURL command, a log excerpt. Valid JSON is scanned structurally so each finding reports its field path; everything else is scanned as text and reports a line and column. | | View | The original text with each secret marked in place, or a redacted copy with every secret replaced by a fixed-width mask. | ## What you get back | Output | Meaning | | --- | --- | | Findings | One row per detected secret: the credential type, a masked preview, and where it sits — a field path for JSON, a line and column for text. | | Cleaned copy | Your original content with every detected secret replaced. Formatting, key order and comments are preserved exactly, because the replacement is made on the text you pasted rather than on a re-serialised copy. | | Count by type | How many of each credential type were found, most frequent first. | ## How it works - Each detection rule is a named regular expression anchored on a known credential format, so a match identifies which vendor the credential belongs to rather than just flagging a random string. - Valid JSON is walked structurally and every string leaf is tested, which is what allows a finding to report its field path. - A value that is already a Postman variable reference is not reported, so content you have already cleaned up does not come back as a finding. - The mask is a fixed width regardless of the secret it replaces, so the redacted copy does not leak how long the original was. - Detection runs on the same WebAssembly engine Postman uses in-product, compiled from Rust and executed inside the page. ## Key terms - **Hardcoded secret** — a credential written directly into a file or payload instead of being read from a variable or a secret store. It leaks whenever that file is shared, committed or exported. - **Redaction** — replacing a secret with a meaningless placeholder so the surrounding content can be shared. Distinct from encryption: redaction is not reversible, which is the point. - **Variable reference** — a named stand-in such as a double-brace token that Postman resolves at send time from an environment or a vault, so the real value never sits in the request itself. - **False positive** — a string that matches a credential format but is not a live credential — a documentation example, a test fixture, a random hash. Rules anchored on vendor prefixes keep these rare. - **Secret reference** — a token that points to a secret in your secret store instead of containing it. Passport issues a reference rather than the key, and binds it cryptographically to the consumer it was issued to, so an intercepted reference does not work for anyone else. - **Passport Proxy** — a container running inside your own cloud, next to your secret store. It authenticates the caller, checks the grant, swaps the reference for the real secret and forwards the request — so the credential is used without ever being handed out. - **Postman Vault** — a local, encrypted store for secrets on your own machine. Vault values are referenced by name from requests and are never synced to Postman servers. ## Questions ### Is anything I paste uploaded? No. Detection runs on a WebAssembly engine loaded into the page, and the scan happens in your browser. What you paste is not sent to Postman or anywhere else, and it is not stored — closing the tab discards it. ### Which kinds of secrets does it detect? Common vendor credential formats: AWS access keys, Google API keys, GitHub and GitLab tokens, Stripe keys, Slack tokens and webhooks, SendGrid, Twilio, OpenAI and Anthropic keys, npm and PyPI tokens, Postman API keys, PEM private keys, JSON Web Tokens, and credentials embedded in a URL. ### Will it catch every secret? No, and it is worth being clear about that. The rules here anchor on recognisable vendor formats, which keeps false positives low but means a bare high-entropy password or an internal credential with no distinctive shape can pass unnoticed. A clean result means nothing recognised was found, not that the content is definitely safe. ### Why is my JSON output formatted the same as my input? Deliberately. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. That makes the result safe to paste straight back over the original. ### Can I paste the redacted copy straight back? Yes. The replacement is applied to the exact text you pasted, so indentation, key order and any comments survive untouched and only the secrets differ. Note that the redacted copy is for sharing, not for running — the masks are not placeholders your tooling can resolve. ### How is this different from the scanner inside Postman? Same detection engine, far narrower scope. This scans one thing you paste, on demand. Inside Postman the scanner runs on every save across your requests, environments and collections, uses a larger rule set plus any custom patterns your team adds, can move a detected secret into your vault for you, and gives team admins a dashboard of what has been found and resolved. ### How do I stop leaking credentials in the first place? Stop handing them out. Passport by Postman gives a developer or an AI agent a vault reference rather than the real credential, and a proxy running inside your own cloud resolves it at call time. The secret never reaches a machine, so it cannot end up in a config file, a log or an agent context. Endpoints are grouped by host and requested with a reason; an admin approves, and the resulting grant can be revoked without rotating the secret or redeploying anything. Every call is attributed to the caller. It works with HashiCorp Vault, AWS Secrets Manager or Google Cloud Secret Manager. ### I pasted a cURL — what do I do with it now? Take the same command to Passport by Postman. Its importer reads a pasted cURL, groups the endpoints it finds by host, and asks you to map each secret it detects to a vault reference. From then on that endpoint is something your team requests access to rather than something you hold a key for, and the key stays in your own vault. ### Can I scan more than one thing at a time? Not on this page — it scans what you paste. For everything else on your machine there is the Passport CLI Community Edition, a free npm package: run passport lens start and it inspects the API calls your tools and AI agents actually make, reporting the credentials in each one with the values masked. It needs no account and, like this page, does all its processing locally. ### Do I need an account? No. There is no signup, no session and no limit on how many times you scan. ## Privacy Nothing you paste leaves your browser. Detection runs locally on a WebAssembly engine loaded into the page — there is no API call, no upload and no server-side scan. Content is held in memory only, is never written to storage, and is discarded when you close the tab. Telemetry records that the tool was used, never what was scanned. ## Links - [Use the tool](https://www.postman.com/tools/redact-secrets) — the interactive version of this page. - [Postman Tools](https://www.postman.com/tools) — every free tool in this set. - [Passport by Postman docs](https://docs.usepassport.ai/passport/get-started/basics/concepts) — Postman documentation.