Mask API keys, tokens, emails and account numbers before pasting them into tickets or chat. Choose how many characters stay visible, the mask character, and whether to hide the real length.
Share the shape of a secret without sharing the secret. Paste a token, key, email or account number and choose how much of the start and end stays visible. Everything between is replaced with a mask character, so a colleague can confirm which credential you mean without ever seeing it.
–
Masking is not encryption. If a secret has already been exposed, rotate it instead of masking it.
Masking is a sharing tool, not a security control
What masking actually protects
Redacting the middle of a credential solves one narrow problem well: it lets you talk about a secret without transmitting it. Support tickets, bug reports, screenshots and chat threads all leak credentials constantly, usually because someone needed to confirm which key was in use, not what the key was. Showing sk_live_51H8...FgH answers the first question completely and the second one not at all.
That is the whole value proposition, and it is worth being precise about the limits. Masking is a one-way, lossy transformation applied for human communication. It is not encryption, because there is no key and no intended path back. It is not hashing, because it is not designed to resist anything. It is closer to how a receipt prints the last four digits of a card: enough to identify, not enough to use.
Choosing how much to reveal
Every visible character is a character an attacker does not have to guess, so the prefix and suffix should be as short as the identification task allows. Four characters at each end is a reasonable default for long random tokens, and it is what most vendor dashboards show. For short values, keep less: revealing four characters of an eight-character PIN leaves almost nothing.
Structured values deserve extra thought because the visible part may be more informative than it looks. Many API keys carry a meaningful prefix, and sk_live_ versus sk_test_ is exactly the distinction you usually want to preserve. Email addresses are the opposite trap: keeping the domain is usually fine, but the local part plus a small domain can identify a single person, which turns a masked string back into personal data.
This tool refuses to let the first and last windows overlap. If the two settings would together cover the whole string, it shrinks them, because the failure mode of an overlapping mask is printing the original value in full.
Length leakage and fixed width
A mask that preserves length preserves information. The number of asterisks tells a reader exactly how long the secret is, which narrows a brute-force search and can identify the credential type outright, since many key formats have a fixed length. For a password in particular, publishing the length is a real concession.
The fixed-width option replaces the entire middle with a constant run of mask characters regardless of the true length, so every masked value looks the same size. Use it whenever the output will be seen by someone outside your team. Keep the length-preserving default when you are debugging with colleagues and the length itself is diagnostic, for example when you suspect a truncated environment variable.
Finally, treat this as a formatting step, never as an incident response. If a live secret has already appeared in a ticket, a log or a repository, masking the copy changes nothing about the original exposure. Rotate the credential first, then mask what you paste from then on.
FAQ
Can the masked text be reversed?
No. The masked characters are discarded, not encoded, so there is nothing to decode. Only the characters you chose to keep visible remain.
How many characters should stay visible?
As few as still let you identify the value. Four at each end suits long random tokens; for short values such as a PIN, reveal less or nothing at all.
What does fixed width do?
It replaces the middle with a constant number of mask characters so the output never reveals the real length. Use it for anything shared outside your team.
Is my input sent to a server?
No. The masking runs entirely in your browser with JavaScript, which is what makes it safe to paste a live credential here.
Can I mask an email and keep it recognisable?
Yes, keep the last characters so the domain survives. Be careful: a short local part plus a small domain can still identify one person.
A key leaked. Is masking enough?
No. Masking only affects the copy you are about to share. Rotate the exposed credential first, then use masking for future messages.