Config & Log Redaction Checker
100% client-side — nothing is transmitted
Paste a server.cfg block, a console log, or an error message before you post it in Discord, a GitHub issue, or a support ticket. This tool scans it in your browser for 14 named patterns that commonly indicate secrets, and gives you a redacted copy plus an explanation for each finding. Nothing you paste is ever sent anywhere, logged, or stored — there is no server behind this page.
Nothing you paste here ever leaves this page
There is no fetch call, no upload, and nothing is logged or stored anywhere — the scan runs as plain JavaScript in your browser tab and the text disappears the moment you close or refresh it. Open your browser's network tab if you want to confirm that yourself. This tool surfaces likely secrets; it does not certify that none remain — read the redacted copy yourself before you send it anywhere.
Redacted copy — select all, or use the button
Redacted output appears here as you paste.
What this scans for, and what it does not guarantee.
What it does
- Scans pasted text against a named list of patterns that commonly indicate secrets or personal data.
- Produces a redacted copy with each match replaced by a labeled placeholder, ready to select and copy.
- Explains, per finding, what the pattern usually is and why it is worth stripping before you share the text.
What it does NOT do
- Does not guarantee the redacted copy is safe to post — it surfaces likely secrets, it does not certify their absence.
- Does not send, log, or store anything you paste; everything happens in memory in your browser tab.
- Does not replace rotating a credential that was actually exposed — redacting text after the fact does not undo a leak.
Three steps.
- 01
Paste the config block, log, or error message you're about to send somewhere into the box.
- 02
Read the findings list and the redacted copy — both update as you type or paste.
- 03
Copy the redacted version and use your own judgment before sending it: this tool flags likely secrets, it does not certify their absence.
The most common leak isn't a hack. It's a paste.
Asking for help means sharing evidence — a config, a console log, an error. The fastest way to get that evidence out the door is to paste the whole thing, and the whole thing often contains a database password, a Cfx license key, or a Discord webhook sitting a few lines away from the actual problem. None of those need to be public for someone to help you: the error message is almost always the useful part, not the credential next to it. This tool exists to catch that before you hit send, whether the destination is our support ticket form (which redacts again server-side as its own floor) or anywhere else.
Before you trust a clean scan.
Does this tool store, log, or send what I paste?
No — never. The scan runs as plain JavaScript in your browser tab. There is no server endpoint behind this page, nothing is written to a database or a log, and the text disappears the moment you close or refresh the tab. Open your browser's network tab while using it if you want to confirm that yourself.
What does it actually look for?
14 named patterns, including database connection strings, a Cfx server license key (sv_licenseKey) or platform key, Discord bot tokens and webhook URLs, JWTs, Steam Web API keys, HTTP bearer tokens, generically named API keys and access tokens, email addresses, and IPv4 addresses. Every pattern is designed to favor a false positive over a miss — it would rather flag something harmless than let something dangerous through unredacted.
It flagged something that isn't actually a secret — why?
By design. A random 12-character string assigned to a variable named token, or a version number that happens to look like an IP address, can trip these patterns. That trade-off is deliberate: for a tool whose entire job is catching things before they go public, a false positive costs you a moment's double-check, while a miss can cost a compromised server.
Does a clean scan mean my paste is safe to post?
No. It means none of this tool's named patterns matched — it does not certify that the text contains no secret, and it cannot recognize a secret format it doesn't know about. Read the redacted copy yourself before sending it anywhere, and never paste a live credential into a public channel, redacted preview or not.
I pasted something and it turned out to be a real secret — what now?
Rotate or revoke it immediately at the source — regenerate the key in Keymaster, reset the Discord webhook or bot token, change the database password. Redacting text after the fact does not undo an exposure if the original value was ever posted, committed, or sent somewhere before you caught it.
Getting install help? Install Concierge redacts again on the server as a second floor, and submitting a ticket drafts a redacted summary for you. Two more browser-only tools: the start order checker and the resmon total & frame budget calculator. Back to the tools hub.
This tool matches text against a named list of patterns and favors false positives over misses. It is not a certification that a paste is safe, and it does not replace rotating a credential that was actually exposed.
Last verified: 2026-09-02