Log Sanitizer

1. Paste a log into the input box, or open a .log, .txt or .json file.
2. Choose what to detect. The defaults cover most cases; switch categories off if you want to keep something readable.
3. Pick a cleaning strength: Readable keeps the shape of values so the log is still easy to follow, Strict masks more aggressively.
4. Run the sanitizer, then read the output and the mapping table before copying it.
5. Add a custom rule if your organisation has an identifier the built-in detectors cannot know about.

What you enter

Raw text from an application, server, API or security log. Any plain-text format works, including JSON lines, key=value logs, syslog and stack traces.

What you get

The same text with sensitive values replaced by masked values, a count of what was found by category, and a mapping table that lets you see which placeholder stands for which kind of value.

• Developers attaching logs to bug reports, support tickets or issues
• Support and operations staff forwarding customer logs to a vendor
• Anyone about to paste a log into a chat, a forum or an AI assistant

Masking versus redaction

Masking replaces part or all of a value with placeholder characters but keeps its shape, which helps you tell two different users apart. Redaction removes the value entirely. The Readable and Strict modes sit on that spectrum.

Why logs contain sensitive data

Logs record what software saw. Request URLs carry query strings with tokens, headers carry credentials and cookies, error messages echo user input and connection strings, and debug output often prints whole objects. Nobody decided to log a password; it was inside something that was logged.

Identifiers are personal data too

Email addresses, phone numbers and IP addresses can identify a person even when no name is present, and session IDs and device identifiers can let someone act as them. They deserve the same care as an obvious secret.

• Support tickets and vendor support: send enough to reproduce a problem without handing over customer data.
• GitHub issues and Stack Overflow questions: public posts are permanent and indexed.
• Slack, Teams and email: messages are copied, forwarded and searched long after the incident.
• AI assistants: pasted text may be stored under the provider's terms.
• Incident reports and post-mortems that will be read by a wider audience than the responders.

Sharing the output without reading it

Detectors work from patterns. Read the result once before it leaves your hands, especially free-text fields and unusual identifiers.

Treating a masked copy as proof the secret is safe

If a real credential was ever in a log that left your control, assume it is exposed and rotate it. Masking the copy does not un-leak the original.

Switching off categories to make the log shorter

Turning detectors off keeps those values in the output. Disable a category only when you are sure the value is harmless.

Forgetting values that are specific to your system

Internal customer IDs, project codenames and host naming schemes are invisible to a general tool. Add a custom rule for them.

A secret was not masked

Check that the matching category is enabled, try Strict mode, or add a custom rule with a pattern for that format. Then report the format on the Contact page so detection can improve.

Too much was masked and the log is hard to read

Use Readable mode and turn off categories such as host names or UUIDs if you need them to follow the flow.

A file will not open

Use .log, .txt or .json files under the size limit, or paste the text instead.

The Log Sanitizer page runs in your browser. The log you paste or open is not sent to DevCraftKit. Custom rules you create are saved in your browser's local storage on your device. Reloading the page clears the input. Full details are in the Privacy Policy.

• What Is Log Sanitization? Why It Matters and How to Do It
• How to Remove Sensitive Data from Logs: A Step-by-Step Guide
• What Sensitive Data Should Never Be Stored in Logs?
• Log Redaction vs Log Masking: What's the Difference?