API keys & tokens
OpenAI, Anthropic, Stripe, GitHub, AWS, Google, Slack, JWTs, Bearer tokens, private key blocks and any long mixed token.
sk-ant-… → ⟦key:sk-•••⟧
redact-secrets masks emails, phone numbers, API keys, passwords, cards, IBANs and national IDs in your prompts, and in the files and command output Claude's tools read, before the model sees them. Locally, with no network and no setup.
/plugin install redact-secrets --marketplace webdiego/redact-secrets
This runs the mod's own patterns in your browser. Nothing you type leaves this page.
Every match becomes ⟦kind:abc•••⟧: the model still knows what was there, you still know which value it was.
OpenAI, Anthropic, Stripe, GitHub, AWS, Google, Slack, JWTs, Bearer tokens, private key blocks and any long mixed token.
Values of PASSWORD=, api_key:, *_TOKEN and the password in user:pass@host URLs. Env lookups stay.
Any address, Unicode letters included.
International formats and native numerals: Arabic, Persian, Devanagari.
13 to 19 digits, with spaces or dashes.
Every country, spaces optional.
Nine countries, switchable from /config.
Dates, times, IP addresses, commit hashes, UUIDs, years, prices and ports. Logs stay readable.
One hooks module, running inside Claude Code on the exact text you send and every tool result the model reads.
prompt.submit fires before the prompt enters the session. Slash commands pass through untouched.
Matches become placeholders. The engine, the model, the stored transcript and other plugins only see the masked text.
tool.call masks what Read, Bash, WebFetch and MCP tools return. An Edit or Write that would put a placeholder over a real value is refused.
If the check ever breaks, the prompt is dropped and the tool output withheld, never passed on unmasked.
Pick the national ID formats to cover and the highlight color at install, or later from /config. The toast speaks 35 languages.
Free, open source, MIT licensed. Active immediately, no restart.