CryptoAPIsOffline: nothing is sent

Redact keys and tokens before you share

Paste a cURL command, request log, HTTP headers or JSON. Detected secrets are listed with the reason they were flagged; choose which to replace, then copy or download the redacted text. The output is checked to make sure none of the chosen values remain.

This workspace is memory-only: nothing you paste is saved, sent, or written to the address bar. Detection is pattern-based and can miss secrets; review before sharing.

Memory only: not saved, not sent, not put in the URL.

Detected (6)
  • API key in URL path Infura-style project ID in the URL path
    …nnet.infura.io/v3/012••••••••••••ef \ -H 'Con…
  • Auth header value Credential-bearing HTTP header
    …H 'Authorization: Bea••••••••••••J5' \ --data…
  • Token in query string Secret-looking query parameter
    …nvalid/eth?apikey=DEM••••••••••••42&format=json…
  • Auth header value Credential-bearing HTTP header
    …t=json X-Api-Key: dem••••••••••••77 {"provider"…
  • Secret-named field Value of a secret-named JSON field
    …xample","apiKey":"dem••••••••••••et","result":"…
  • Long opaque token Long mixed letter/digit string. May be an identifier, may be a key; review.
    …ic, not flagged): 0xa••••••••••••ab
Verified: 0 value(s) replaced
curl -sS -X POST https://mainnet.infura.io/v3/0123456789abcdef0123456789abcdef \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJkZW1vLWNhbmFyeSJ9.ZmFrZS1zaWduYXR1cmUtY2FuYXJ5' \
  --data-raw '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'

GET https://rpc.example.invalid/eth?apikey=DEMO_CANARY_KEY_42&format=json
X-Api-Key: demo-canary-header-key-777
{"provider":"example","apiKey":"demo-canary-json-secret","result":"0x1"}
tx hash (public, not flagged): 0xabababababababababababababababababababababababababababababababab

Unselected detections are kept as-is in the output. Detection is pattern-based; read the result before sharing.

Memory only. Reloading the page clears this workspace.

What gets flagged

  • Keys in RPC URL paths (Infura-style /v3/…, Alchemy-style /v2/…, long opaque path segments).
  • Credentials in URLs (user:password@host) and secret-looking query parameters (apikey, token, key, signature…).
  • Authorization, X-API-Key, Cookie and similar header values, and Bearer tokens.
  • JWTs, values of JSON fields named apiKey, secret, password, privateKey, mnemonic and similar.
  • 32-byte hex labelled as a private key, PEM private-key blocks, and 12–24-word runs shaped like seed phrases.
  • Optional, off by default: emails, IPv4 addresses and long opaque tokens.

Verified output

Each chosen value is replaced everywhere it appears with a stable placeholder such as <REDACTED:provider-key#1>, so the structure of a log stays readable. After replacement the output is searched for every chosen original value; if any remains, copying and downloading are blocked.

If you pasted a real private key or seed phrase

This site never needs one. Treat it as exposed: move funds with a wallet you trust and stop using that key. Redacting a copy does not undo exposure elsewhere.

Questions

Is anything I paste stored?

No. The redaction workspace keeps text only in page memory. Reloading the page clears it.

Why is a transaction hash not flagged?

Hashes, addresses and calldata are public on-chain data. 64-hex strings are flagged only when labelled as a key.

Can I rely on this to catch every secret?

No tool can. It catches common formats and shows you what it found; read the output before you share it.